ICS Emergency Response Procedures 3

Question 1

What is the MAIN reason ICS emergency response exercises should include physical process scenarios, not just IT scenarios?

Accepted Answer

Because ICS incidents can have physical consequences that require coordinated cyber-physical response

Answer

ICS cyber incidents can cause physical harm to people, equipment, and the environment, so exercises must address the convergence of cyber and physical response.

Question 2

During forensic evidence collection after an ICS incident, why is it important to document the chain of custody?

Accepted Answer

To preserve evidence integrity for potential legal proceedings or regulatory reporting

Answer

Chain of custody documentation ensures evidence was collected, handled, and stored properly, making it admissible in legal or regulatory proceedings.

Question 3

Which of the following is a key difference between IT incident response and ICS incident response?

Accepted Answer

ICS response must prioritize safety and process continuity, not just data confidentiality

Answer

Unlike IT environments where confidentiality is paramount, ICS incident response must prioritize personnel safety and maintaining critical process operations.

Question 4

What is a 'tabletop exercise' in the context of ICS emergency response?

Accepted Answer

A discussion-based simulation where responders walk through an incident scenario verbally

Answer

A tabletop exercise is a facilitated, discussion-based activity where response team members verbally walk through their actions for a given emergency scenario.

Question 5

When an ICS vendor's remote support connection is suspected as the entry point for an attack, what is the FIRST response action?

Accepted Answer

Terminate or block the vendor's remote access connection immediately

Answer

Immediately blocking the suspected malicious access vector stops ongoing attacker activity and prevents further compromise before investigation continues.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Emergency Response Procedures 3