User authentication and authorization in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Authentication vs Authorization

Which statement correctly describes the difference between authentication and authorization in a SCADA system?

A Authentication and authorization both verify the user's identity only.

B Authentication determines what the user can access; authorization verifies who the user is.

C Authorization is done before authentication in the access process.

D Authentication verifies who the user is; authorization determines what the user can access.

💡 Hint

Think about logging in first, then checking permissions.

Authentication confirms the user's identity, while authorization checks their permissions.

💻 Command Output

intermediate

Result of User Login Command

What is the output of the following SCADA system command when a user enters correct credentials?

SCADA systems

login --user=operator --password=correctpass

A Login failed: User not found.

B Error: Invalid password.

C Login successful: Access granted to operator dashboard.

D System error: Unable to connect to authentication server.

💡 Hint

Correct credentials should allow access.

When credentials are correct, the system grants access and confirms login success.

❓ Configuration

advanced

Configuring Role-Based Access Control (RBAC)

Which configuration snippet correctly assigns the 'engineer' role permission to modify control parameters in a SCADA system?

A

[roles]
engineer=read,write,view_only

B

[roles]
engineer=read,write,modify_controls

C

[roles]
engineer=read,execute_scripts

D

[roles]
engineer=read,write,delete_logs

💡 Hint

Look for permissions that include modifying controls.

The 'modify_controls' permission allows the engineer role to change control parameters, which is required.

❓ Troubleshoot

advanced

Diagnosing Access Denied Error

A user with the 'technician' role tries to access the alarm settings but receives 'Access Denied'. Which is the most likely cause?

A The technician role lacks permission to modify alarm settings.

B The user's password has expired.

C The SCADA system is offline.

D The user is not authenticated.

💡 Hint

Consider role permissions related to the requested resource.

Access denied usually means the role does not have the required permission, not authentication or system status issues.

🔀 Workflow

expert

Correct Sequence for Secure User Access Setup

What is the correct order of steps to securely set up a new user in a SCADA system?

A 1,2,3,4

B 2,1,3,4

C 3,1,2,4

D 1,3,2,4

💡 Hint

Think about creating the user first, then assigning roles, then setting password, then testing.

The user must be created first, then roles assigned, password set, and finally tested to ensure access.