ICS Security Risk Management and Incident Response 5

Question 1

The concept of 'tabletop exercises' in ICS incident response refers to:

Accepted Answer

Discussion-based simulations where participants walk through an incident scenario without activating actual response procedures

Answer

Tabletop exercises use scenario-based discussions to evaluate the incident response plan, test decision-making, and identify gaps without disrupting live operations.

Question 2

When an ICS organization transfers risk by purchasing cyber insurance, which residual obligation remains?

Accepted Answer

The organization must still implement reasonable security controls as required by the insurance policy

Answer

Cyber insurance policies require the insured to maintain minimum security standards; failing to do so can void coverage, meaning organizations still must manage the risk.

Question 3

Which metric BEST measures the effectiveness of an ICS incident response program over time?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) trends across incidents

Answer

MTTD and MTTR measure how quickly threats are detected and contained, directly reflecting the operational effectiveness of the incident response program.

Question 4

During the 'eradication' phase of ICS incident response, the primary goal is to:

Accepted Answer

Remove all traces of the attacker and eliminate the root cause from affected systems

Answer

Eradication focuses on removing malware, closing attack vectors, and eliminating the root cause to prevent reinfection before recovery begins.

Question 5

A facility uses the MITRE ATT&CK for ICS framework during incident response. Its primary value is:

Accepted Answer

Offering a common taxonomy of adversary tactics, techniques, and procedures (TTPs) specific to ICS environments

Answer

MITRE ATT&CK for ICS provides a structured knowledge base of ICS-specific adversary behaviors, enabling teams to map observed activity to known attack patterns.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Security Risk Management and Incident Response 5