GRID ICS Security Standards and Compliance 2

Question 1

Under NERC CIP, a 'BES Cyber Asset' (BCA) is classified based on its potential impact to the BES. Which classification carries the highest compliance burden?

Accepted Answer

High Impact

Answer

Low Impact

Answer

Medium Impact

Answer

Critical Impact

Question 2

NIST SP 800-82 recommends which network architecture strategy when IT and OT systems must exchange data?

Accepted Answer

Implementation of a DMZ with firewalls between IT and OT

Answer

Full integration of IT and OT on a flat network

Answer

Complete air-gapping with no electronic connectivity

Answer

Direct peer-to-peer connections secured only by encryption

Question 3

Which NERC CIP standard addresses 'Systems Security Management,' including management of ports and services, security patches, and malicious code prevention?

Accepted Answer

CIP-007-6

Answer

CIP-004-6

Answer

CIP-005-7

Answer

CIP-009-6

Question 4

IEC 62443 Part 2-1 focuses on which aspect of IACS security?

Accepted Answer

Establishing an Industrial Automation and Control System Security Management System (CSMS)

Answer

Technical security requirements for IACS components

Answer

Patch management procedures for embedded devices

Answer

Security requirements for IACS suppliers

Question 5

What is the primary purpose of the NIST Cybersecurity Framework (CSF) 'Identify' function as applied to ICS environments?

Accepted Answer

Developing organizational understanding to manage cybersecurity risk to systems and assets

Answer

Detecting anomalous activity on OT networks in real time

Answer

Responding to and recovering from cybersecurity incidents

Answer

Implementing safeguards to limit the impact of cybersecurity events

Question 6

Under NERC CIP-006, which requirement category specifically addresses the physical security of BES Cyber System locations?

Accepted Answer

Physical Security Plans and Physical Security Perimeters

Answer

Electronic Access Controls

Answer

Remote Access Management

Answer

Incident Reporting and Response Planning

Question 7

In IEC 62443, the term 'Target Security Level' (SL-T) is set by whom?

Accepted Answer

The asset owner or operator based on risk assessment

Answer

The component supplier or manufacturer

Answer

The regulatory authority mandating compliance

Answer

The system integrator during installation