Emergency Response Procedures Flashcards
7 cards from real ICS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Emergency Response Procedures flashcards as text
What is the MAIN reason ICS emergency response exercises should include physical process scenarios, not just IT scenarios?
Answer: Because ICS incidents can have physical consequences that require coordinated cyber-physical response
ICS cyber incidents can cause physical harm to people, equipment, and the environment, so exercises must address the convergence of cyber and physical response.
During forensic evidence collection after an ICS incident, why is it important to document the chain of custody?
Answer: To preserve evidence integrity for potential legal proceedings or regulatory reporting
Chain of custody documentation ensures evidence was collected, handled, and stored properly, making it admissible in legal or regulatory proceedings.
Which of the following is a key difference between IT incident response and ICS incident response?
Answer: ICS response must prioritize safety and process continuity, not just data confidentiality
Unlike IT environments where confidentiality is paramount, ICS incident response must prioritize personnel safety and maintaining critical process operations.
What is a 'tabletop exercise' in the context of ICS emergency response?
Answer: A discussion-based simulation where responders walk through an incident scenario verbally
A tabletop exercise is a facilitated, discussion-based activity where response team members verbally walk through their actions for a given emergency scenario.
When an ICS vendor's remote support connection is suspected as the entry point for an attack, what is the FIRST response action?
Answer: Terminate or block the vendor's remote access connection immediately
Immediately blocking the suspected malicious access vector stops ongoing attacker activity and prevents further compromise before investigation continues.
Which NIST publication provides guidance specifically relevant to ICS/SCADA incident response?
Answer: NIST SP 800-82
NIST SP 800-82 'Guide to Industrial Control Systems Security' provides ICS-specific security guidance including incident response considerations.
What is the purpose of maintaining a 'golden image' or known-good backup of ICS software configurations?
Answer: To enable rapid restoration of systems to a verified secure state after an incident
Known-good configuration backups allow rapid and confident restoration of ICS systems to a trusted state after malware removal or system compromise.