ISA ISA Certifications ISA-IEC-62443 Questions & Answers

• Question 51:

  Which is a PRIMARY reason why network security is important in IACS environments?

  Available Choices (select all choices that are correct)

  A. PLCs are inherently unreliable.

  B. PLCs are programmed using ladder logic.

  C. PLCs use serial or Ethernet communications methods.

  D. PLCs under cyber attack can have costly and dangerous impacts.

  Correct Answer: D

  Network security is important in IACS environments because PLCs, or programmable logic controllers, are devices that control physical processes and equipment in industrial settings. PLCs under cyber attack can have costly and dangerous impacts, such as disrupting production, damaging equipment, compromising safety, and harming the environment. Therefore, network security is essential to protect PLCs and other IACS components from unauthorized access, modification, or disruption. The other choices are not primary reasons why network security is important in IACS environments. PLCsare not inherently unreliable, but they can be affected by environmental factors, such as temperature, humidity, and electromagnetic interference. PLCs are programmed using ladder logic, which is a graphical programming language that resembles electrical schematics. PLCs use serial or Ethernet communications methods, depending on the type and age of the device, to communicate with other IACS components, such as human- machine interfaces (HMIs), supervisory control and data acquisition (SCADA) systems, and distributed control systems (DCSs). References: ISA/IEC 62443 Standards to Secure Your Industrial Control System training course1 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide2 Using the ISA/IEC 62443 Standard to Secure Your Control Systems3

• Question 52:

  What does the abbreviation CSMS round in ISA 62443-2-1 represent?

  Available Choices (select all choices that are correct)

  A. Control System Management System

  B. Control System Monitoring System

  C. Cyber Security Management System

  D. Cyber Security Monitoring System

  Correct Answer: C

  The abbreviation CSMS stands for Cyber Security Management System in ISA 62443-2-1. This standard defines the elements necessary to establish a CSMS for industrial automation and control systems (IACS) and provides guidance on how to develop those elements123. A CSMS is a collection of policies, procedures, practices, and personnel that are responsible for ensuring the security of IACS throughout their lifecycle24. References: 1: ISA/IEC 62443 Series of Standards - ISA 2: ISA 62443-2-1 - Security for industrial automation and control systems, Part 2-1: Establishing an Industrial Automation and Control Systems Security Program | GlobalSpec 3: IEC 62443-2-1:2010 | IEC Webstore | cyber security, smart city 4: Structuring the ISA/IEC 62443 Standards - ISAGCA

• Question 53:

  Which of the following is a recommended default rule for IACS firewalls?

  Available Choices (select all choices that are correct)

  A. Allow all traffic by default.

  B. Allow IACS devices to access the Internet.

  C. Allow traffic directly from the IACS network to the enterprise network.

  D. Block all traffic by default.

  Correct Answer: D

  A recommended default rule for IACS firewalls is to block all traffic by default, and then allow only the necessary and authorized traffic based on the security policy and the zone and conduit model. This is also known as the principle of least privilege, which means granting the minimum access required for a legitimate purpose. Blocking all traffic by default provides a higher level of security and reduces the attack surface of the IACS network. The other choices are not recommended default rules for IACS firewalls, as they may expose the IACS network to unnecessary risks. Allowing all traffic by default would defeat the purpose of a firewall, as it would not filter any malicious or unwanted traffic. Allowing IACS devices to access the Internet would expose them to potential cyber threats, such as malware, phishing, or denial-of-service attacks. Allowing traffic directly from the IACS network to the enterprise network would bypass the demilitarized zone (DMZ), which is a buffer zone that isolates the IACS network from the enterprise network and hosts services that need to communicate between them. References: ISA/IEC 62443 Standards to Secure Your Industrial Control System training course1 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide2 Using the ISA/IEC 62443 Standard to Secure Your Control Systems3

• Question 54:

  Which of the following can be employed as a barrier device in a segmented network?

  Available Choices (select all choices that are correct)

  A. Router

  B. Unmanaged switch

  C. VPN

  D. Domain controller

  Correct Answer: A

  A router and a VPN can be employed as barrier devices in a segmented network. A barrier device is a device that controls the flow of traffic between different network segments, based on predefined rules and policies1. A router is a device that forwards packets between different networks, based on their IP addresses2. A router can act as a barrier device by applying access control lists (ACLs) or firewall rules to filter or block unwanted or malicious traffic2. A VPN is a technology that creates a secure andencrypted tunnel between different networks, such as a remote site and a corporate network3. A VPN can act as a barrier device by encrypting the traffic and authenticating the users or devices that access the network3. A VPN can also prevent unauthorized access or eavesdropping by outsiders3. References: LAYERING NETWORK SECURITY - CISA, Router (computing) - Wikipedia, What Is Network Segmentation? - Cisco.

• Question 55:

  Which layer specifies the rules for Modbus Application Protocol

  Available Choices (select all choices that are correct)

  A. Data link layer

  B. Session layer

  C. Presentation layer

  D. Application layer

  Correct Answer: D

  The Modbus Application Protocol is a messaging protocol that provides client/server communication between devices connected on different types of buses or networks. It is positioned at level 7 of the OSI model, which is the application layer. The application layer is the highest level of the OSI model and defines the rules and formats for data exchange between applications. The Modbus Application Protocol is independent of the underlying communication layers and can be implemented using different transport protocols, such as TCP/IP, serial, or Modbus Plus. The Modbus Application Protocol defines the function codes, data formats, and error codes for Modbus transactions123 References: MODBUS APPLICATION PROTOCOL SPECIFICATION V1 Modbus - Wikipedia Overview of Modbus -- EPICS support for Modbus - GitHub Pages

• Question 56:

  What is the name of the missing layer in the Open Systems Interconnection (OSI) model shown below?

  

  A. Control

  B. Protocol

  C. Transport

  D. User

  Correct Answer: C

  The Open Systems Interconnection (OSI) model is a framework that describes the functions of a networking system. The OSI model categorizes the computing functions of the different network components, outlining the rules and

  requirement needed to support the interoperability of the software and hardware that make up the network1. The OSI model consists of seven abstraction layers arranged in a top-down order:

  Physical, Data Link, Network, Transport, Session, Presentation, and Application. The Transport layer is the fourth layer in the OSI model, and it is responsible for ensuring reliable and efficient data transfer between the Network layer and the

  Session layer2. The Transport layer uses protocols such as Transmission Control Protocol (TCP)and User Datagram Protocol (UDP) to provide end-to-end communication services, such as error detection and correction, flow control,

  congestion control, and segmentation2. The image that you sent shows a 3D representation of the OSI model, with the layers stacked on top of each other. The missing layer is the Transport layer, which is represented by a pink box with a

  white arrow pointing to it. The arrow is labeled "TCP, UDP".

  1: What is the OSI Model? 7 Network Layers Explained | Fortinet 2: What is OSI Model | 7 Layers Explained - GeeksforGeeks

• Question 57:

  Authorization (user accounts) must be granted based on which of the following?

  Available Choices (select all choices that are correct)

  A. Individual preferences

  B. Common needs for large groups

  C. Specific roles

  D. System complexity

  Correct Answer: C

  Authorization is the process of granting or denying access to a network resource or function. Authorization (user accounts) must be granted based on specific roles, which are defined as sets of permissions and responsibilities assigned to a user or a group of users. Roles should be based on the principle of least privilege, which means that users should only have the minimum level of access required to perform their tasks. Roles should also be based on the principle of separation of duties, which means that users should not have conflicting or overlapping responsibilities that could compromise the security or integrity of the system. Authorization based on individual preferences or common needs for large groups is not recommended, as it could lead to excessive or unnecessary access rights, or to inconsistent or conflicting policies. Authorization based on system complexity is also not a good criterion, as it could result in overcomplicated or unclear roles that are difficult to manage or audit. References: ISA/IEC 62443-3-3:2013 - Security for industrial automation and control systems - Part 3-3: System security requirements and security levels1 ISA/IEC 62443-2-1:2010 - Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program2 ISA/IEC 62443-4-1:2018 - Security for industrial automation and control systems - Part 4-1: Product security development life-cycle requirements3

• Question 58:

  Multiuser accounts and shared passwords inherently carry which of the followinq risks?

  Available Choices (select all choices that are correct)

  A. Privilege escalation

  B. Buffer overflow

  C. Unauthorized access

  D. Race conditions

  Correct Answer: C

  Multiuser accounts and shared passwords are accounts and passwords that are used by more than one person to access a system or a resource. They inherently carry the risk of unauthorized access, which means that someone who is not authorized or intended to use the account or password can gain access to the system or resource, and potentially compromise its confidentiality, integrity, or availability. For example, if a multiuser account and password are shared among several operators of an industrial automation and control system (IACS), an attacker who obtains the password can use the account to access the IACS and perform malicious actions, such as changing the system settings, deleting data, or disrupting the process. Multiuser accounts and shared passwords also make it difficult to track and audit the activities of individual users, and to enforce the principle of least privilege, which states that users should only have the minimum level of access required to perform their tasks. Therefore, the ISA/IEC 62443 standards recommend avoiding the use of multiuser accounts and shared passwords, and instead using individual accounts and strong passwords for each user, and implementing authentication and authorization mechanisms to control the access to the IACS. References: ISA/IEC 62443-3-3:2013 - Security for industrial automation and control systems - Part 3-3: System security requirements and security levels1 ISA/IEC 62443-2-1:2009 - Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program2 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Training Course3

• Question 59:

  Which of the following ISA-99 (IEC 62443) Reference Model levels is named correctly?

  Available Choices (select all choices that are correct)

  A. Level 1: Supervisory Control

  B. Level 2: Quality Control

  C. Level 3: Operations Management

  D. Level 4: Process

  Correct Answer: AC

  The ISA-99 (IEC 62443) Reference Model levels are based on the Purdue Enterprise Reference Architecture (PERA) and describe how data flows through industrial networks. The levels are as follows1:

  Level 0: The physical process, where the actual production or operation takes place.

  Level 1: Basic control, where sensors and actuators monitor and manipulate the physical process.

  Level 2: Supervisory control, where human-machine interfaces (HMIs) and controllers coordinate and optimize the basic control functions. Level 3: Operations management, where production scheduling, inventory management, quality

  control, and other functions are performed. Level 4: Business planning and logistics, where enterprise resource planning (ERP), customer relationship management (CRM), and other business functions are performed.

  Therefore, the correct names for level 1 and level 3 are supervisory control and operations management, respectively. Level 2 is not quality control, but supervisory control. Level 4 is not process, but business planning and logistics.

  References: 1: Key Concepts of ISA/IEC 62443: Zones and Security Levels | Dragos

• Question 60:

  Within the National Institute of Standards and Technoloqv Cybersecuritv Framework v1.0 (NIST CSF), what is the status of the ISA 62443 standards?

  Available Choices (select all choices that are correct)

  A. They are used as informative references.

  B. They are used as normative references.

  C. They are under consideration for future use.

  D. They are not used.

  Correct Answer: A

  The NIST CSF is a voluntary framework that provides a set of standards, guidelines, and best practices to help organizations manage cybersecurity risks. The NIST CSF consists of five core functions: Identify, Protect, Detect, Respond, and Recover. Each function is further divided into categories and subcategories that describe specific outcomes and activities. The NIST CSF also provides informative references that link the subcategories to existing standards, guidelines, and practices that can help organizations achieve the desired outcomes. The informative references are not mandatory or exhaustive, but rather serve as examples of possible sources of guidance. The ISA 62443 standards are used as informative references in the NIST CSF v1.0 for several subcategories, especially in the Protect and Detect functions. The ISA 62443 standards are a series of standards that provide a framework for securing industrial automation and control systems (IACS). The ISA 62443 standards cover various aspects of IACS security, such as terminology,concepts, requirements, policies, procedures, and technical specifications. The ISA 62443 standards are aligned with the NIST CSF in terms of the core functions and the risk-based approach. Therefore, the ISA 62443 standards can provide useful guidance and best practices for organizations that use IACS and want to implement the NIST CSF. References: NIST Cybersecurity Framework - Official Site1 Framework for Improving Critical Infrastructure Cybersecurity - Version 1.02 ISA/IEC 62443 Standards - Official Site3 ISA/IEC 62443 Compliance and Scoring | Centraleyes4