SOPD SCADA Systems 4 — Questions and Answers
Question 1: Which cybersecurity control is most important for protecting SCADA systems from unauthorized remote access?
- Installing antivirus software on all RTUs
- Network segmentation with firewalls between the SCADA network and corporate IT networks (Correct answer)
- Disabling all SCADA displays during off-peak hours
- Using only wireless communication to avoid physical tap points
Correct answer: Network segmentation with firewalls between the SCADA network and corporate IT networks
Network segmentation with firewalls isolates the SCADA operational technology (OT) network from corporate IT and the internet, significantly reducing the attack surface for cyber threats.
Question 2: What does NERC CIP require regarding remote access to SCADA systems classified as BES Cyber Systems?
- Remote access must use only dial-up modem connections
- Remote access must be secured with multi-factor authentication and monitored (Correct answer)
- Remote access is completely prohibited for all BES Cyber Systems
- Remote access is only allowed during NERC-approved maintenance windows
Correct answer: Remote access must be secured with multi-factor authentication and monitored
NERC CIP-005 requires that interactive remote access to BES Cyber Systems use encrypted communications and multi-factor authentication, with session monitoring and logging.
Question 3: During a SCADA system failover to the backup master station, what is the operator's primary concern?
- Ensuring the backup station has current real-time data and control capability before relying on it (Correct answer)
- Restarting all RTUs to re-establish communication with the new master
- Manually re-entering all analog setpoints into the backup system
- Placing all automatic controls in manual mode indefinitely
Correct answer: Ensuring the backup station has current real-time data and control capability before relying on it
During failover, operators must verify the backup master has synchronized current data and confirmed communication with field RTUs before trusting its displays for operational decisions.
Question 4: What is the role of a SCADA historian in power system operations?
- It serves as the backup master station during primary system outages
- It archives time-series data for post-event analysis, trending, and regulatory compliance (Correct answer)
- It performs real-time state estimation for the EMS functions
- It manages alarm prioritization and operator notification routing
Correct answer: It archives time-series data for post-event analysis, trending, and regulatory compliance
The historian continuously archives timestamped SCADA data, enabling operators and engineers to replay events, analyze trends, and meet NERC reliability standard record-keeping requirements.
Question 5: When an operator performs a 'manual entry' or 'substitution' on a SCADA point, what are they doing?
- Sending a control command to change the field device state
- Overriding the measured value with a manually entered value when the RTU data is unreliable (Correct answer)
- Resetting an RTU's firmware to factory defaults
- Configuring a new RTU communication channel
Correct answer: Overriding the measured value with a manually entered value when the RTU data is unreliable
Manual substitution replaces a suspect or unavailable RTU measurement with an operator-entered value so the energy management system can continue functioning with reasonable data.
Question 6: Which condition would cause a SCADA analog point to enter 'bad quality' status?
- The measured value matches the operator's expected value
- The RTU reports a measurement that exceeds the configured engineering range limits (Correct answer)
- The point value has not changed for more than one scan cycle
- The alarm threshold for the point has been modified by a supervisor
Correct answer: The RTU reports a measurement that exceeds the configured engineering range limits
A bad quality flag is set when the RTU returns a value outside the configured reasonable engineering range, indicating a possible sensor failure, wiring problem, or RTU error.
Question 7: In SCADA alarm management, what is the purpose of alarm 'deadband' or 'hysteresis' settings?
- Prevent alarms from being displayed during system maintenance periods
- Avoid alarm chattering by requiring the value to return past a threshold offset before the alarm clears (Correct answer)
- Prioritize alarms based on equipment criticality level
- Delay alarm annunciation until the condition persists for a defined time
Correct answer: Avoid alarm chattering by requiring the value to return past a threshold offset before the alarm clears
Deadband settings require a measurement to recover past the alarm threshold by a specified amount before the alarm clears, preventing repeated alarm/clear cycling when a value oscillates near the limit.
SOPD SCADA Systems 4
Which cybersecurity control is most important for protecting SCADA systems from unauthorized remote access?