SACA Industrial Cybersecurity (OT/ICS Security)

Question 1

What is the primary security concern that differentiates Operational Technology (OT) networks from traditional IT networks?

Accepted Answer

In OT environments, availability and safety are paramount — a security patch or system reboot can halt production or cause physical harm, making patch management far more constrained than in IT

Answer

In IT, the CIA triad prioritizes Confidentiality first. In OT/ICS, Availability and Safety come first — a cyber incident that stops a power plant or chemical process can have catastrophic physical consequences. This inverts patch management and security tool deployment strategies compared to IT environments.

Question 2

The Purdue Reference Model (ISA-99) is used in ICS security to:

Accepted Answer

Segment industrial networks into hierarchical levels (field devices → control → operations → enterprise) to limit lateral movement of threats

Answer

The Purdue Model divides ICS architecture into levels (Level 0: field devices, Level 1: controllers, Level 2: supervisory/SCADA, Level 3: operations/MES, Level 4: enterprise/IT). Network segmentation between levels — using firewalls and DMZs — limits an attacker's ability to move from the IT network down to process control systems.

Question 3

Which international standard series specifically addresses cybersecurity for Industrial Automation and Control Systems (IACS)?

Accepted Answer

IEC 62443

Answer

IEC 62443 (formerly ISA-99) is the definitive international standard series for IACS cybersecurity. It covers policies, procedures, system design, and component requirements for securing industrial control systems. ISO 27001 addresses general IT security management; IEC 61511 covers functional safety (SIL), not cybersecurity.

Question 4

A 'Defense-in-Depth' strategy in ICS security means:

Accepted Answer

Applying multiple overlapping layers of security controls so that if one layer fails, others still protect critical assets

Answer

Defense-in-Depth applies multiple independent security layers — physical access controls, network segmentation, application whitelisting, anomaly detection, patch management, and incident response — so that no single point of failure exposes critical control systems. It is the foundational security architecture principle recommended by IEC 62443 and NIST.

Question 5

What was the primary attack vector used by the Stuxnet malware to compromise Iranian nuclear facility PLCs?

Accepted Answer

Exploitation of zero-day Windows vulnerabilities spread via infected USB drives to reach air-gapped systems

Answer

Stuxnet spread through infected USB drives, exploiting multiple Windows zero-day vulnerabilities to bridge the air gap. Once inside, it specifically targeted Siemens S7-300 PLCs controlling centrifuge motors, subtly altering their speed while reporting normal status — the first publicly known cyberweapon targeting physical industrial infrastructure.

SACA - Smart Automation Certification Alliance Practice Test

SACA - Smart Automation Certification Alliance Practice Test

SACA Industrial Cybersecurity (OT/ICS Security)