ISA 62443 IC33 3 RISK ELEMENTS EXAM QUESTIONS
AND ANSWERS WITH COMPLETE SOLUTIONS GRADED
A++
What is the risk equation?
Risk = Threat x Vulnerability
What is a threat source?
Person, group, or environment that can present a threat
What are common threat sources?
Authorized internal personnel
Authorized 3rd party
Unauthorized internal personnel
Unauthorized external person (hacker)
Malware
Equipment
Environment
Other
Any
What is a threat vector?
Potential medium that a threat source may leverage to compromise a zone or conduit
, What is Spoofing?
Deliberate act to assume an identity in order to gain unauthorized access.
What is Tampering?
Unauthorized changes to a program, configuration, or data
What is Information Disclosure?
Unauthorized redirection of data
What is a Denial-of-Service attack?
Deny, degrade, or destroy access to data or resources
What is a Threat Catalog?
An organized list of potential threats to a system that includes information about the
nature of each threat, related vulnerabilities, affected assets, potential impacts, and
possible mitigation strategies. It's a crucial tool for risk management in IACS
cybersecurity.
What ISA/IEC 62443 standard establishes criteria for threat sources and actions?
ISA/IEC-62443-3-2
Vulnerability
Any flaw or weakness in a system's design
(True/False) Vulnerability Analysis is the same thing as Cyber Risk Analysis.
False
(True/False) Not all vulnerabilities represent risk to an IACS network.
True
(True/False) All vulnerabilities lead to a consequence.
False
AND ANSWERS WITH COMPLETE SOLUTIONS GRADED
A++
What is the risk equation?
Risk = Threat x Vulnerability
What is a threat source?
Person, group, or environment that can present a threat
What are common threat sources?
Authorized internal personnel
Authorized 3rd party
Unauthorized internal personnel
Unauthorized external person (hacker)
Malware
Equipment
Environment
Other
Any
What is a threat vector?
Potential medium that a threat source may leverage to compromise a zone or conduit
, What is Spoofing?
Deliberate act to assume an identity in order to gain unauthorized access.
What is Tampering?
Unauthorized changes to a program, configuration, or data
What is Information Disclosure?
Unauthorized redirection of data
What is a Denial-of-Service attack?
Deny, degrade, or destroy access to data or resources
What is a Threat Catalog?
An organized list of potential threats to a system that includes information about the
nature of each threat, related vulnerabilities, affected assets, potential impacts, and
possible mitigation strategies. It's a crucial tool for risk management in IACS
cybersecurity.
What ISA/IEC 62443 standard establishes criteria for threat sources and actions?
ISA/IEC-62443-3-2
Vulnerability
Any flaw or weakness in a system's design
(True/False) Vulnerability Analysis is the same thing as Cyber Risk Analysis.
False
(True/False) Not all vulnerabilities represent risk to an IACS network.
True
(True/False) All vulnerabilities lead to a consequence.
False
