Physical Security Operations Flashcards
7 cards from real ICS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Physical Security Operations flashcards as text
In ICS physical security, what is a 'security zone' as defined by IEC 62443?
Answer: A grouping of assets with common security requirements and a defined perimeter
IEC 62443 defines security zones as logical or physical groupings of assets that share security requirements and are bounded by a defined perimeter.
An ICS technician finds an unattended USB drive near a substation entrance. According to best practice, what should they do?
Answer: Submit it to the security team without connecting it to any device
Unattended media should be treated as potentially malicious and turned in to security personnel without being connected to any system.
What is the function of a 'dead man' alarm in a remote ICS field site?
Answer: Triggers when a field technician fails to check in within a defined interval
A dead man (man-down) alarm triggers when a lone worker fails to periodically check in, indicating a possible incapacitation or security incident.
Which of the following BEST describes 'defense in depth' as applied to ICS physical security?
Answer: Layering multiple independent physical barriers and detection systems
Defense in depth creates multiple independent layers so that defeating one control does not grant full access; each layer forces the attacker to overcome an additional barrier.
A power utility must escort all visitors inside its Electronic Security Perimeter (ESP). If an escort leaves a visitor unattended briefly, what is the MOST likely compliance violation?
Answer: NERC CIP-006 physical security escort requirement
NERC CIP-006 requires that visitors inside a Physical Security Perimeter be continuously escorted or monitored at all times.
What is the PRIMARY security purpose of installing anti-ram bollards at the entrance of a critical ICS facility?
Answer: Stopping vehicle-borne improvised explosive device (VBIED) or ram-raid attacks
Anti-ram bollards are designed to physically stop vehicles from being used as weapons or as a means to breach the facility entrance.
Which cryptographic technology is used in modern smart access cards to make credential cloning significantly more difficult than legacy 125 kHz proximity cards?
Answer: Public-key cryptography with challenge-response authentication
Smart cards use public-key cryptography where the reader issues a challenge that only the card's private key can answer, preventing replay of captured credentials.