ICS Physical Security Operations 2 — Questions and Answers
Question 1: Which physical security control is MOST effective at preventing tailgating into a restricted ICS control room?
- Security guard stationed at entry
- Mantrap (airlock) vestibule (Correct answer)
- Video surveillance camera
- Proximity card reader
Correct answer: Mantrap (airlock) vestibule
A mantrap vestibule enforces one-person-at-a-time entry, physically preventing tailgating regardless of social engineering.
Question 2: An ICS facility wants to detect unauthorized excavation near buried pipeline control cables. Which technology is BEST suited for this?
- Infrared perimeter sensors
- Fiber-optic distributed acoustic sensing (DAS) (Correct answer)
- CCTV with PTZ cameras
- Microwave motion detectors
Correct answer: Fiber-optic distributed acoustic sensing (DAS)
Distributed acoustic sensing detects vibration and mechanical disturbance along buried fiber-optic cable, alerting to unauthorized digging.
Question 3: What is the PRIMARY purpose of a CIKR (Critical Infrastructure and Key Resources) site's visitor management system?
- Automate badge printing for employees
- Maintain an auditable log of all non-employee access (Correct answer)
- Control HVAC access for contractors
- Integrate with HR onboarding workflows
Correct answer: Maintain an auditable log of all non-employee access
Visitor management systems create an auditable record of who entered, when, and under whose escort, supporting accountability and incident investigation.
Question 4: During an ICS security assessment, auditors find that substation doors use padlocks from multiple vendors with varying key grades. What is the BEST remediation?
- Replace all padlocks with a standardized high-security keyed-alike system (Correct answer)
- Add alarm sensors to each existing padlock
- Implement biometric locks on all doors
- Document the current key inventory and archive it
Correct answer: Replace all padlocks with a standardized high-security keyed-alike system
Standardizing to high-security, keyed-alike padlocks reduces key management complexity and ensures uniform resistance to picking and forced entry.
Question 5: A control room operator notices an unknown person photographing HMI screens through a window. Which immediate response action is MOST appropriate?
- Shut down all HMI displays
- Contact security personnel and document the incident (Correct answer)
- Confront the individual directly and demand identification
- Lock the SCADA workstations remotely
Correct answer: Contact security personnel and document the incident
Contacting security and documenting the incident ensures a trained response while preserving evidence without personal risk to the operator.
Question 6: Which lighting standard is MOST commonly referenced for securing the perimeter of US critical infrastructure facilities at night?
- IESNA RP-33 Security Lighting (Correct answer)
- NFPA 72 Emergency Lighting
- ANSI/UL 924 Exit Lighting
- IEEE 141 Industrial Power Systems
Correct answer: IESNA RP-33 Security Lighting
IESNA RP-33 provides recommended practices for security lighting, including lux levels for perimeters, parking areas, and building entrances.
Question 7: What is 'crime prevention through environmental design' (CPTED) and how does it apply to ICS facilities?
- Installing environmental sensors to detect chemical threats
- Designing the physical environment to deter unauthorized access and criminal behavior (Correct answer)
- Using natural ventilation to reduce HVAC attack surface
- Planting trees as cover for security personnel
Correct answer: Designing the physical environment to deter unauthorized access and criminal behavior
CPTED uses natural surveillance, access control, and territorial reinforcement through facility design to deter threats before they reach ICS assets.
ICS Physical Security Operations 2
Which physical security control is MOST effective at preventing tailgating into a restricted ICS control room?