ICS Emergency Response Procedures 2

Question 1

During an ICS security incident, what is the PRIMARY purpose of an Incident Response Plan (IRP)?

Accepted Answer

To provide structured steps for detecting, containing, and recovering from incidents

Answer

An IRP provides a structured, pre-defined set of procedures to detect, contain, eradicate, and recover from security incidents in a consistent and timely manner.

Question 2

Which containment strategy is MOST appropriate when an ICS operator workstation is suspected of malware infection during active production?

Accepted Answer

Isolate the workstation from the network while maintaining manual process control

Answer

Network isolation of the suspected workstation limits malware spread while allowing manual control to maintain safety and production continuity.

Question 3

In ICS emergency response, what does the term 'safe state' refer to?

Accepted Answer

A pre-defined operational condition where the physical process poses minimal hazard

Answer

A safe state is a pre-engineered operational condition designed to minimize hazard to personnel, equipment, and the environment during an emergency.

Question 4

When should ICS operators switch from automated control to manual control during a cyber incident?

Accepted Answer

When automated systems are confirmed compromised and manual control can maintain safety

Answer

Switching to manual control is warranted when automated systems are compromised and human operators can safely maintain process control to prevent harm.

Question 5

What is the role of Out-of-Band (OOB) communications during an ICS cyber incident?

Accepted Answer

To provide a communication channel that is independent of potentially compromised networks

Answer

OOB communications (e.g., landlines, satellite phones) allow responders to coordinate without relying on networks that may be compromised.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Emergency Response Procedures 2