SACA Industrial Cybersecurity (OT/ICS Security)

Question 1

What is the primary security concern that differentiates Operational Technology (OT) networks from traditional IT networks?

Accepted Answer

In OT environments, availability and safety are paramount — a security patch or system reboot can halt production or cause physical harm, making patch management far more constrained than in IT

Answer

OT networks transmit larger data volumes and require higher bandwidth protection

Answer

OT networks use stronger encryption standards that IT security tools cannot inspect

Answer

OT systems are air-gapped by regulation, so external threats are not a concern

Question 2

The Purdue Reference Model (ISA-99) is used in ICS security to:

Accepted Answer

Segment industrial networks into hierarchical levels (field devices → control → operations → enterprise) to limit lateral movement of threats

Answer

Define PLC ladder logic programming standards across vendors

Answer

Specify the encryption algorithms required for SCADA historian databases

Answer

Standardize the physical wiring topology of industrial Ethernet networks

Question 3

Which international standard series specifically addresses cybersecurity for Industrial Automation and Control Systems (IACS)?

Accepted Answer

IEC 62443

Answer

ISO 27001

Answer

NIST SP 800-53

Answer

IEC 61511

Question 4

A 'Defense-in-Depth' strategy in ICS security means:

Accepted Answer

Applying multiple overlapping layers of security controls so that if one layer fails, others still protect critical assets

Answer

Deploying a single, highly advanced firewall at the IT/OT boundary

Answer

Encrypting all historian data at rest using AES-256 as the sole security measure

Answer

Physically air-gapping all OT networks from any IT or internet connectivity

Question 5

What was the primary attack vector used by the Stuxnet malware to compromise Iranian nuclear facility PLCs?

Accepted Answer

Exploitation of zero-day Windows vulnerabilities spread via infected USB drives to reach air-gapped systems

Answer

A phishing email sent directly to plant operators

Answer

A remote exploit over the public internet targeting SCADA web interfaces

Answer

SQL injection attacks on the plant's historian database

Question 6

What does 'network segmentation with a DMZ' accomplish in an ICS architecture?

Accepted Answer

It creates an intermediate buffer zone between IT and OT networks where data exchange servers are hosted, preventing direct connections between enterprise and control networks

Answer

It eliminates the need for antivirus software on OT endpoints

Answer

It allows remote vendors to directly access PLCs for maintenance without passing through any firewall

Answer

It replaces the need for physical access controls to the control room