ICS Access Control & Perimeter Security 3

Question 1

An operator must perform emergency maintenance on a PLC at 2 AM with no time to follow normal change management. Which access control approach best balances security and safety?

Accepted Answer

Use a 'break-glass' emergency account with full logging and mandatory post-incident review

Answer

Break-glass procedures provide emergency privileged access through a controlled, fully audited mechanism while preserving accountability and triggering mandatory review after the incident.

Question 2

Which network segmentation approach provides the STRONGEST isolation between ICS levels in the Purdue Model?

Accepted Answer

Physical separation with firewall-controlled conduits at each level boundary

Answer

Physical separation enforced by dedicated firewalls at each Purdue level boundary provides defense-in-depth, ensuring that a breach at one level cannot directly propagate without crossing a controlled inspection point.

Question 3

A vendor requires persistent VPN access to monitor a turbine control system. What is the MOST secure way to grant this access?

Accepted Answer

Provide a jump server in the DMZ with the vendor's access scoped to specific assets and time windows

Answer

A jump server in the DMZ with least-privilege, time-limited, and asset-scoped access enforces the principle of least privilege while keeping vendor traffic isolated from the broader OT network.

Question 4

What is the purpose of an 'Electronic Access Point' (EAP) as defined in NERC CIP-005?

Accepted Answer

Any point of access into an Electronic Security Perimeter that must be controlled and monitored

Answer

An EAP is any routable communication path crossing the ESP boundary, and CIP-005 requires that each EAP be controlled, logged, and protected with appropriate access management.

Question 5

Physical perimeter security for ICS sites should include which element specifically recommended by ICS security frameworks?

Accepted Answer

Two-person integrity (TPI) rules for access to critical control areas

Answer

Two-person integrity requires that no single individual can access critical control areas alone, reducing insider threat risk and preventing unauthorized unwitnessed actions on critical systems.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Access Control & Perimeter Security 3