ISA ISA Certifications ISA-IEC-62443 Questions & Answers

• Question 61:

  Which factor drives the selection of countermeasures?

  Available Choices (select all choices that are correct)

  A. Foundational requirements

  B. Output from a risk assessment

  C. Security levels

  D. System design

  Correct Answer: B

  The selection of countermeasures is driven by the output from a risk assessment, which identifies the risks and their associated likelihood and consequences for each zone and conduit in the industrial automation and control system (IACS). The risk assessment also determines the target security level (SL-T) for each zone and conduit, which represents the desired level of protection against the identified threats. The countermeasures are then selected based on the SL-T and the existing security level (SL- A) of the zone and conduit, as well as the cost and feasibility of implementation. The countermeasures should aim to reduce the risk to an acceptable level by increasing the SL- A to meet or exceed the SL-T. References: ISA/IEC 62443-3-2:2018 - Security risk assessment for system design, ISA/IEC 62443-3-3:2013 - System security requirements and security levels, ISA/IEC 62443 Cybersecurity Fundamentals Specialist Training Course

• Question 62:

  Which service does an Intrusion Detection System (IDS) provide?

  Available Choices (select all choices that are correct)

  A. It is the lock on the door for networks and computer systems.

  B. It is effective against all vulnerabilities in networks and computer systems.

  C. It blocks malicious activity in networks and computer systems.

  D. It detects attempts to break into or misuse a computer system.

  Correct Answer: D

  An intrusion detection system (IDS) is a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations. The IDS sends alerts to IT and security teams when it detects any security risks and threats. However, an IDS does not block or prevent the malicious activity, it only detects and reports it. Therefore, an IDS is not the lock on the door for networks and computer systems, nor is it effective against all vulnerabilities in networks and computer systems. An IDS can be combined with an intrusion prevention system (IPS) to block the malicious activity in real time. References: What is Intrusion Detection Systems (IDS)? How does it Work? | Fortinet1 Intrusion Detection System (IDS) - GeeksforGeeks2 What is an intrusion detection system (IDS)? - IBM3

• Question 63:

  Which of the following is an example of separation of duties as a part of system development and maintenance?

  Available Choices (select all choices that are correct)

  A. Changes are approved by one party and implemented by another.

  B. Configuration settings are made by one party and self-reviewed using a checklist.

  C. Developers write and then test their own code.

  D. Design and implementation are performed by the same team.

  Correct Answer: A

  Separation of duties is a security principle that aims to prevent fraud, errors, conflicts of interest, or misuse of resources by dividing critical tasks or functions among different people or teams. It is one of the foundational requirements (FRs) of the ISA/IEC 62443 standards for securing industrial automation and control systems (IACSs). According to the ISA/IEC 62443-2-1 standard, separation of duties includes the following system requirements (SRs): SR 2.1: Security management policy SR 2.2: Personnel security SR 2.3: System development and maintenance SR 2.4: Incident response and recovery SR 2.5: Compliance and review Among these SRs, the one that is most related to the example of system development and maintenance is SR 2.3. SR 2.3 requires that the IACS shall provide the capability to ensure that the development and maintenance of the system and its components are performed in a secure manner. This means that the IACS should have a mechanism to control the access and authorization of developers, testers, integrators, and maintainers who work on the system and its components. It also means that the IACS should have a mechanism to verify and validate the quality and security of the system and its components before, during, and after the development and maintenance processes. Therefore, an example of separation of duties as a part of system development and maintenance is that changes are approved by one party and implemented by another. This ensures that the changes are authorized, documented, and reviewed by someone who is not involved in the implementation. This reduces the risk of introducing errors, vulnerabilities, or malicious code into the system and its components. References: ISA/IEC 62443-2-1:2010, Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program1 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Certificate Program2 ISA/IEC 62443 Cybersecurity Library3 Using the ISA/IEC 62443 Standards to Secure Your Control Systems4

• Question 64:

  Which of the following is the underlying protocol for Ethernet/IP?

  Available Choices (select all choices that are correct)

  A. Building Automation and Control Network (BACnet)

  B. Common Industrial Protocol

  C. Highway Addressable Remote Transducer (HART)

  D. Object Linking and Embedding (OLE) for Process Control

  Correct Answer: B

  Ethernet/IP is an industrial network protocol that adapts the Common Industrial Protocol (CIP) to standard Ethernet. CIP is an object-oriented protocol that provides a unified communication architecture for various industrial automation applications, such as control, safety, security, energy, synchronization and motion, information and network management. CIP defines a set of messages and services for interacting with devices and data on the network, as well as a set of device profiles for consistent implementation of automation functions across different products. Ethernet/IP uses the transport and control protocols of standard Ethernet, such as TCP/IP and IEEE 802.3, to define the features and functions for its lower layers. Ethernet/IP also uses UDP to transport I/O messages and supports various network topologies, such as star, linear, ring and wireless. Ethernet/IP is one of the leading industrial protocols in the United States and is widely used in a range of industries, such as factory, hybrid and process. Ethernet/IP is managed by ODVA, Inc., a global trade and standards development organization. References: EtherNet/IP - Wikipedia EtherNet/IP | ODVA Technologies | Industrial Automation

• Question 65:

  What is the name of the protocol that implements serial Modbus over Ethernet?

  Available Choices (select all choices that are correct)

  A. MODBUS/CIP

  B. MODBUS/Ethernet

  C. MODBUS/Plus

  D. MODBUS/TCP

  Correct Answer: D

  MODBUS/TCP is the name of the protocol that implements serial Modbus over Ethernet. MODBUS/TCP is a variant of the Modbus protocol that uses the Transmission Control Protocol (TCP) as the transport layer to encapsulate Modbus messages and send them over Ethernet networks. MODBUS/TCP preserves the Modbus application layer and data model, which means that serial Modbus devices can communicate with MODBUS/TCP devices through a gateway or a converter. MODBUS/TCP is widely used in industrial automation and control systems, as it offers high performance, interoperability, and compatibility with existing Modbus devices. References: ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 3.1.21; MODBUS Application Protocol Specification V1.1b3, Section 1.1

• Question 66:

  What is a feature of an asymmetric key?

  Available Choices (select all choices that are correct)

  A. Uses a continuous stream

  B. Uses different keys

  C. Shares the same key OD.

  D. Has lower network overhead

  Correct Answer: B

  An asymmetric key is a feature of asymmetric cryptography, also known as public-key cryptography, which is a method of encrypting and decrypting data using two differentkeys: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret by the owner. The public key and the private key are mathematically related, but it is computationally infeasible to derive one from the other. Asymmetric cryptography can be used for various purposes, such as digital signatures, key exchange, and encryption. For example, if Alice wants to send a message to Bob, she can use Bob's public key to encrypt the message, and only Bob can decrypt it using his private key. Alternatively, if Bob wants to prove that he is the author of a message, he can use his private key to sign the message, and anyone can verify it using his public key. Asymmetric cryptography has some advantages over symmetric cryptography, which uses the same key for both encryption and decryption. For instance, asymmetric cryptography does not require a secure channel to distribute the keys, and it can provide non-repudiation and authentication. However, asymmetric cryptography also has some drawbacks, such as higher computational complexity, larger key sizes, and higher network overhead. References: ISA/IEC 62443-3-3:2018, Section 4.2.3.6.1, Cryptography1 ISA/IEC 62443-4-2:2019, Section 4.2.3.6.1, Cryptography ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 5.3.1, Cryptography ISA/IEC 62443 Cybersecurity Fundamentals Specialist Exam Specification, Section 5.3.1, Cryptography

• Question 67:

  Which steps are included in the ISA/IEC 62443 assess phase?

  Available Choices (select all choices that are correct)

  A. Cybersecurity requirements specification and detailed cyber risk assessment

  B. Cybersecurity requirements specification and allocation of IACS assets to zones and conduits

  C. Detailed cyber risk assessment and cybersecurity maintenance, monitoring, and management of change

  D. Allocation of IACS assets to zones and conduits, and detailed cyber risk assessment

  Correct Answer: D

  According to the ISA/IEC 62443 standards, the assess phase of the IACS cybersecurity lifecycle consists of two steps: allocation of IACS assets to zones and conduits, and detailed cyber risk assessment. The first step involves identifying and documenting the IACS assets and grouping them into logical zones based on their security requirements and functions. The second step involves performing a cybersecurity vulnerability and risk assessment for each zone and conduit, using the information from the previous step and the cybersecurity requirements specification from the identify phase. The assess phase aims to identify and understand the high-risk vulnerabilities that require mitigation in the design phase. References: ISA/IEC 62443-2-1:2010 - Establishing an industrial automation and control systems security program, section 4.3.2; Cybersecurity Training | ISA England Section

• Question 68:

  Security Levels (SLs) are broken down into which three types?

  Available Choices (select all choices that are correct)

  A. SL-1, SL-2, and SL-3

  B. Target.capability, and achieved

  C. Target.capability, and availability

  D. Target.capacity, and achieved

  Correct Answer: B

  Security Levels (SLs) are a way of expressing the security performance of an industrial automation and control system (IACS) or its components. SLs are broken down into three types: target, capability, and achieved1. Target SL is the level of security performance that is required for a system or component to protect against a specific threat scenario. The target SL is determined by conducting a risk assessment that considers the likelihood and impact of potential security

  incidents1.

  Capability SL is the level of security performance that a system or component can provide based on its design and implementation. The capability SL is determined by evaluating the security functions and features of the system or component

  against a set of security requirements1.

  Achieved SL is the level of security performance that a system or component actually provides in its operational environment. The achieved SL is determined by verifying that the system or component is properly installed, configured,

  maintained, and monitored1.

  References: ISA/IEC 62443 Standards to Secure Your Industrial Control System, page 3- 4.

• Question 69:

  Which of the following provides the overall conceptual basis in the design of an appropriate security program?

  Available Choices (select all choices that are correct)

  A. Asset model

  B. Zone model

  C. Reference model

  D. Reference architecture

  Correct Answer: C

  The reference model provides the overall conceptual basis in the design of an appropriate security program. It defines the common terminology, concepts, and models that can be used by all stakeholders responsible for IACS security. The reference model describes the general characteristics of IACS, the typical threats and vulnerabilities, the security lifecycle phases, and the security levels. The reference model also introduces the concepts of zones and conduits, which are used to group and isolate assets with similar security requirements and to control the communication between them. Referenceshttps://www.cisco.com/c/en/us/td/docs/solutions/Verticals/IoT_Security_L ab/IEC62443_WP.pdf https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/IoT_Security_Lab/IEC62443_WP .pdf

• Question 70:

  Electronic security, as defined in ANSI/ISA-99.00.01:2007. includes which of the following?

  Available Choices (select all choices that are correct)

  A. Security guidelines for the proper configuration of IACS computers and operating systems

  B. Computers, networks, operating systems, applications, and other programmable configurable components of the system

  C. Personnel, policies, and procedures related to the security of computers, networks. PLCs, and other programmable configurable components of the system

  D. Security guidelines for the proper configuration of IACS PLCs and other programmable configurable components of the system

  Correct Answer: B

  Electronic security, as defined in ANSI/ISA-99.00.01:2007, is the discipline that addresses the requirements and implementation of measures to counter threats to the confidentiality, integrity, and availability of the computers, networks, operating systems, applications, and other programmable configurable components of the system1. Electronic security covers the technical aspects of protecting the system from unauthorized access, modification, disruption, or destruction, as well as ensuring the availability and reliability of the system. Electronic security does not include the personnel, policies, and procedures related to the security of the system, which are part of the organizational security1. Electronic security also does not include the security guidelines for the proper configuration of the system components, which are part of the security program1. References: 1: ANSI/ISA-99.00.01-2007 Security for Industrial Automation and Control Systems Part 1-1: Terminology, Concepts, and Models