In an industrial security exam, which of the following describes a common incident scenario?

• A. A routine software update.
• B. A phishing email to employees.
• C. A ransomware attack on IT that threatens control systems or an unauthorized access attempt to the control network causing downtime.
• D. A scheduled cybersecurity awareness training.

Answer: (C)

The main concept this question tests is recognizing an incident scenario that could disrupt industrial operations by compromising IT or the control network. A ransomware attack on IT that threatens control systems or unauthorized access to the control network causing downtime directly demonstrates how cyber threats can impact operational technology and halt production. It shows the real-world consequence of a security breach in an industrial setting.

Routine software updates are routine maintenance and do not constitute an incident by themselves. A phishing email to employees is a common attack vector that could lead to an incident, but it’s not the incident itself—it's a trigger. A scheduled cybersecurity awareness training is a proactive defensive activity, not an incident. Therefore, the ransomware/control-network disruption scenario best represents a plausible, impactful incident in industrial security.