Pearson ISA-IEC-62443 New Attempt

 IPSec is a commonly used protocol for managing secure data transmission over a VPN. IPSec stands for Internet Protocol Security and it is a set of standards that define how to encrypt and authenticate data packets that travel between two or more devices over an IP network. IPSec can operate in two modes: transport mode and tunnel mode. In transport mode, IPSec only encrypts the payload of the IP packet, leaving the header intact. In tunnel mode, IPSec encrypts the entire IP packet and encapsulates it in a new IP header. Tunnel mode is more secure and more suitable for VPNs, as it can protect the original source and destination addresses of the IP packet from eavesdropping or spoofing. IPSec uses two main protocols to provide security services: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides data integrity and source authentication, but not confidentiality. ESP provides data integrity, source authentication, and confidentiality. IPSec also uses two protocols to establish and manage security associations (SAs), which are the parameters and keys used for encryption and authentication: Internet Key Exchange (IKE) and Internet Security Association and Key Management Protocol (ISAKMP). IKE is a protocol that negotiates and exchanges cryptographic keys between two devices. ISAKMP is a protocol that defines the format and structure of the messages used for key exchange and SA management.

OPC Unified Architecture (OPC UA) introduces a browsable namespace that supports hierarchical organization of data including folders, classes, methods, and object types. This is critical for structured access to real-time and historical data across heterogeneous control systems.

“OPC UA provides a flexible, secure, and platform-independent mechanism for exchanging information. Its browsable namespace allows structured navigation of nodes, types, and attributes in a hierarchical format.”

— OPC UA Specification, Part 3 – Address Space Model

This is a key improvement over OPC Classic, which was tightly coupled to DCOM and lacked standardized structures across systems.

A control system, particularly in the context of IACS, is defined as a collection of hardware and software components used to monitor and control industrial processes. This includes PLCs, RTUs, SCADA software, HMIs, and communication networks.

“Control system: A set of hardware and software components that work together to monitor and control industrial or process operations.”

— ISA/IEC 62443-1-1:2007, Clause 3.3.5 – Terminology

While the other options describe security functions or consequences, only Option C accurately describes what a control system is.

Per ISA/IEC 62443-2-1 and 62443-2-3, proper patch management is part of operational cybersecurity. For high-priority or critical security patches, the best practice is to apply the patch at the earliest possible opportunity, often during the next available unscheduled or scheduled outage.

“Asset owners shall define procedures for evaluating and applying patches based on criticality and potential impact. High-priority patches should be applied at the earliest opportunity, preferably at the first available system downtime.”

— ISA/IEC 62443-2-3:2015, Clause 6.1 – Patch Management Process

Waiting unnecessarily or skipping patches because "nothing is broken" is not acceptable in security-critical environments.