# SEAS-8414 Chapter 12 Homework
## Blackboard Multiple-Choice Assessment: Autonomous Remediation with Safety Verification

**Use:** Due before the next Chapter 12 class session
**Total Points:** 100
**Format:** 50 single-correct-answer multiple choice questions, 2 points each
**Audience:** Doctoral students and senior cybersecurity practitioners

This assessment is designed for Blackboard delivery. Every item is multiple choice
with exactly one correct answer. The assessment is closed book: do not use the
textbook, notes, internet search, lab files, scanners, AI tools, or outside
incident writeups while answering.

Each question includes a scenario-provenance label. That label is a citation
trail for instructors and is never required to choose the answer. Every formula,
threshold, rule, or evidence contract required to answer appears inside the stem.

Chapter boundary: answer only within Chapter 12 autonomous remediation, safety verification, and governance only. Do not import capabilities
from other chapters unless the stem explicitly defines them.

---

### Question 1

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority schedules a safe firmware wave. The rule is maintenance_windows = ceil(device_count / max_offline_at_once), and total_minutes = maintenance_windows * minutes_per_window. device_count=24, max_offline_at_once=4, minutes_per_window=40. Which schedule follows?

(a) No determinate answer can be computed from the stated rule.
(b) 4 windows; 160 minutes
(c) 24 windows; 960 minutes
(d) 6 windows; 240 minutes
### Question 2

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility applies the Chapter 12 safety gate. The rule is execute only if simulation_pass, postconditions_pass, approval_granted, and pre_execution_health_green are all true. simulation_pass=True, postconditions_pass=True, approval_granted=True, pre_execution_health_green=True. Which decision follows?

(a) execute with no rollback checkpoint
(b) delete the plan
(c) execute
(d) block execution
### Question 3

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network measures compliance delta with the score rule (passed + 0.5*partial)/13*100. Before remediation: passed=8, partial=2. After remediation: passed=10, partial=1. Which delta follows?

(a) before 80.8%; after 69.2%; delta -11.5 points
(b) before 69.2%; after 80.8%; delta 11.5 points
(c) before 69.2%; after 80.8%; delta 80.8 points
(d) before 61.5%; after 76.9%; delta 15.4 points
### Question 4

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority identifies non-dominated remediation actions. Each tuple is (risk_reduction, cost, downtime). An action is dominated if another action has risk_reduction >= it, cost <= it, downtime <= it, and at least one strict improvement. A=(14, 4, 2), B=(13, 5, 3), C=(16, 7, 1). Which set is non-dominated?

(a) A and C
(b) A only
(c) A, B, and C
(d) B and C
### Question 5

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator generates a micro-segmentation policy. The simplified rule is: each IoT device may connect to each DMZ collector, and each OT controller has exactly one allowed engineering-workstation flow. No IT-to-IoT flows are allowed. IoT devices=27, OT controllers=4, DMZ collectors=3. How many allowed flows are generated?

(a) 34
(b) 81
(c) 112
(d) 85
### Question 6

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator verifies credential rotation. The rule is success only if old credential fails, new credential works, and Vault write succeeds. old_credential_fails=True, new_credential_works=True, vault_write_succeeds=False. Which result follows?

(a) verified but do not store evidence
(b) rollback always required
(c) rotation not verified
(d) rotation verified
### Question 7

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant monitors post-remediation health. The rollback rule is trigger rollback when error_rate > 0.05, latency_ms > 180, or critical_service_lost is true. error_rate=0.01, latency_ms=105, critical_service_lost=False. Which decision follows?

(a) ignore because only one metric failed
(b) continue monitoring
(c) trigger rollback
(d) approve new actions immediately
### Question 8

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network runs a self-healing policy check. The rule is drift_count = planned_rules - applied_rules, and self-healing is required when drift_count > 0. planned_rules=34, applied_rules=32. Which result follows?

(a) drift_count 2; self-healing required
(b) drift_count -2; no self-healing required
(c) drift_count 34; self-healing required
(d) drift_count 2; no self-healing required
### Question 9

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program checks whether an autonomous plan may enter execution. The rule is ready only if dependency_graph_valid, twin_preflight_pass, and approval_satisfied are all true. approval_satisfied is true automatically for non-manual actions and otherwise depends on approval. dependency_graph_valid=False, twin_preflight_pass=True, manual_required=False, approval_granted=not needed. Which readiness result follows?

(a) ready for execution
(b) execute and skip health checks
(c) discard all findings
(d) not ready for execution
### Question 10

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative computes remediation economics. The rule is total_cost = credential_rotations*0.5 + firmware_updates*2.0 + segmentation_policies*1.5 + config_changes*0.8. Risk reduction points are rotations*4 + firmware*9 + segmentation*6 + configs*2. Counts are rotations=8, firmware=2, segmentation=7, configs=6. Which cost and risk-reduction-to-cost ratio follow?

(a) cost 23.3; ratio 0.22
(b) cost 18.5; ratio 5.62
(c) cost 23.3; ratio 4.46
(d) cost 23.0; ratio 4.46
### Question 11

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site schedules a safe firmware wave. The rule is maintenance_windows = ceil(device_count / max_offline_at_once), and total_minutes = maintenance_windows * minutes_per_window. device_count=36, max_offline_at_once=8, minutes_per_window=40. Which schedule follows?

(a) 36 windows; 1440 minutes
(b) 5 windows; 200 minutes
(c) 4 windows; 160 minutes
(d) 8 windows; 320 minutes
### Question 12

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program applies the Chapter 12 safety gate. The rule is execute only if simulation_pass, postconditions_pass, approval_granted, and pre_execution_health_green are all true. simulation_pass=False, postconditions_pass=True, approval_granted=False, pre_execution_health_green=False. Which decision follows?

(a) block execution
(b) execute
(c) execute with no rollback checkpoint
(d) delete the plan
### Question 13

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority measures compliance delta with the score rule (passed + 0.5*partial)/13*100. Before remediation: passed=8, partial=3. After remediation: passed=11, partial=2. Which delta follows?

(a) before 73.1%; after 92.3%; delta 92.3 points
(b) before 61.5%; after 84.6%; delta 23.1 points
(c) before 92.3%; after 73.1%; delta -19.2 points
(d) before 73.1%; after 92.3%; delta 19.2 points
### Question 14

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility identifies non-dominated remediation actions. Each tuple is (risk_reduction, cost, downtime). An action is dominated if another action has risk_reduction >= it, cost <= it, downtime <= it, and at least one strict improvement. A=(14, 4, 3), B=(13, 5, 4), C=(16, 7, 2). Which set is non-dominated?

(a) A, B, and C
(b) B and C
(c) A and C
(d) A only
### Question 15

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network generates a micro-segmentation policy. The simplified rule is: each IoT device may connect to each DMZ collector, and each OT controller has exactly one allowed engineering-workstation flow. No IT-to-IoT flows are allowed. IoT devices=21, OT controllers=6, DMZ collectors=2. How many allowed flows are generated?

(a) 69
(b) 48
(c) 29
(d) 42
### Question 16

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority verifies credential rotation. The rule is success only if old credential fails, new credential works, and Vault write succeeds. old_credential_fails=False, new_credential_works=True, vault_write_succeeds=True. Which result follows?

(a) rotation not verified
(b) rotation verified
(c) verified but do not store evidence
(d) rollback always required
### Question 17

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator monitors post-remediation health. The rollback rule is trigger rollback when error_rate > 0.05, latency_ms > 180, or critical_service_lost is true. error_rate=0.04, latency_ms=205, critical_service_lost=False. Which decision follows?

(a) continue monitoring
(b) approve new actions immediately
(c) ignore because only one metric failed
(d) trigger rollback
### Question 18

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator runs a self-healing policy check. The rule is drift_count = planned_rules - applied_rules, and self-healing is required when drift_count > 0. planned_rules=48, applied_rules=48. Which result follows?

(a) drift_count 48; self-healing required
(b) drift_count 0; self-healing required
(c) drift_count 0; no self-healing required
(d) No determinate answer can be computed from the stated rule.
### Question 19

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant checks whether an autonomous plan may enter execution. The rule is ready only if dependency_graph_valid, twin_preflight_pass, and approval_satisfied are all true. approval_satisfied is true automatically for non-manual actions and otherwise depends on approval. dependency_graph_valid=True, twin_preflight_pass=True, manual_required=False, approval_granted=not needed. Which readiness result follows?

(a) discard all findings
(b) ready for execution
(c) not ready for execution
(d) execute and skip health checks
### Question 20

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network computes remediation economics. The rule is total_cost = credential_rotations*0.5 + firmware_updates*2.0 + segmentation_policies*1.5 + config_changes*0.8. Risk reduction points are rotations*4 + firmware*9 + segmentation*6 + configs*2. Counts are rotations=6, firmware=2, segmentation=9, configs=9. Which cost and risk-reduction-to-cost ratio follow?

(a) cost 27.7; ratio 4.12
(b) cost 26.0; ratio 4.12
(c) cost 27.7; ratio 0.24
(d) cost 20.5; ratio 5.56
### Question 21

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program schedules a safe firmware wave. The rule is maintenance_windows = ceil(device_count / max_offline_at_once), and total_minutes = maintenance_windows * minutes_per_window. device_count=48, max_offline_at_once=6, minutes_per_window=40. Which schedule follows?

(a) No determinate answer can be computed from the stated rule.
(b) 6 windows; 240 minutes
(c) 48 windows; 1920 minutes
(d) 8 windows; 320 minutes
### Question 22

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative applies the Chapter 12 safety gate. The rule is execute only if simulation_pass, postconditions_pass, approval_granted, and pre_execution_health_green are all true. simulation_pass=True, postconditions_pass=True, approval_granted=True, pre_execution_health_green=True. Which decision follows?

(a) execute with no rollback checkpoint
(b) delete the plan
(c) execute
(d) block execution
### Question 23

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site measures compliance delta with the score rule (passed + 0.5*partial)/13*100. Before remediation: passed=8, partial=4. After remediation: passed=12, partial=3. Which delta follows?

(a) before 103.8%; after 76.9%; delta -26.9 points
(b) before 76.9%; after 103.8%; delta 26.9 points
(c) before 76.9%; after 103.8%; delta 103.8 points
(d) before 61.5%; after 92.3%; delta 30.8 points
### Question 24

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program identifies non-dominated remediation actions. Each tuple is (risk_reduction, cost, downtime). An action is dominated if another action has risk_reduction >= it, cost <= it, downtime <= it, and at least one strict improvement. A=(14, 4, 1), B=(13, 5, 2), C=(16, 7, 1). Which set is non-dominated?

(a) A and C
(b) A only
(c) A, B, and C
(d) B and C
### Question 25

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority generates a micro-segmentation policy. The simplified rule is: each IoT device may connect to each DMZ collector, and each OT controller has exactly one allowed engineering-workstation flow. No IT-to-IoT flows are allowed. IoT devices=15, OT controllers=4, DMZ collectors=4. How many allowed flows are generated?

(a) 23
(b) 60
(c) 79
(d) 64
### Question 26

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility verifies credential rotation. The rule is success only if old credential fails, new credential works, and Vault write succeeds. old_credential_fails=True, new_credential_works=True, vault_write_succeeds=True. Which result follows?

(a) verified but do not store evidence
(b) rollback always required
(c) rotation verified
(d) rotation not verified
### Question 27

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network monitors post-remediation health. The rollback rule is trigger rollback when error_rate > 0.05, latency_ms > 180, or critical_service_lost is true. error_rate=0.07, latency_ms=155, critical_service_lost=False. Which decision follows?

(a) ignore because only one metric failed
(b) trigger rollback
(c) continue monitoring
(d) approve new actions immediately
### Question 28

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority runs a self-healing policy check. The rule is drift_count = planned_rules - applied_rules, and self-healing is required when drift_count > 0. planned_rules=62, applied_rules=58. Which result follows?

(a) drift_count 4; self-healing required
(b) drift_count -4; no self-healing required
(c) drift_count 62; self-healing required
(d) drift_count 4; no self-healing required
### Question 29

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator checks whether an autonomous plan may enter execution. The rule is ready only if dependency_graph_valid, twin_preflight_pass, and approval_satisfied are all true. approval_satisfied is true automatically for non-manual actions and otherwise depends on approval. dependency_graph_valid=True, twin_preflight_pass=True, manual_required=False, approval_granted=not needed. Which readiness result follows?

(a) not ready for execution
(b) execute and skip health checks
(c) discard all findings
(d) ready for execution
### Question 30

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator computes remediation economics. The rule is total_cost = credential_rotations*0.5 + firmware_updates*2.0 + segmentation_policies*1.5 + config_changes*0.8. Risk reduction points are rotations*4 + firmware*9 + segmentation*6 + configs*2. Counts are rotations=4, firmware=2, segmentation=5, configs=5. Which cost and risk-reduction-to-cost ratio follow?

(a) cost 17.5; ratio 0.24
(b) cost 13.5; ratio 5.48
(c) cost 17.5; ratio 4.23
(d) cost 16.0; ratio 4.23
### Question 31

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant schedules a safe firmware wave. The rule is maintenance_windows = ceil(device_count / max_offline_at_once), and total_minutes = maintenance_windows * minutes_per_window. device_count=60, max_offline_at_once=4, minutes_per_window=40. Which schedule follows?

(a) 60 windows; 2400 minutes
(b) 15 windows; 600 minutes
(c) No determinate answer can be computed from the stated rule.
(d) 4 windows; 160 minutes
### Question 32

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network applies the Chapter 12 safety gate. The rule is execute only if simulation_pass, postconditions_pass, approval_granted, and pre_execution_health_green are all true. simulation_pass=False, postconditions_pass=True, approval_granted=True, pre_execution_health_green=True. Which decision follows?

(a) block execution
(b) execute
(c) execute with no rollback checkpoint
(d) delete the plan
### Question 33

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program measures compliance delta with the score rule (passed + 0.5*partial)/13*100. Before remediation: passed=8, partial=2. After remediation: passed=10, partial=1. Which delta follows?

(a) before 69.2%; after 80.8%; delta 80.8 points
(b) before 61.5%; after 76.9%; delta 15.4 points
(c) before 80.8%; after 69.2%; delta -11.5 points
(d) before 69.2%; after 80.8%; delta 11.5 points
### Question 34

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative identifies non-dominated remediation actions. Each tuple is (risk_reduction, cost, downtime). An action is dominated if another action has risk_reduction >= it, cost <= it, downtime <= it, and at least one strict improvement. A=(14, 4, 2), B=(13, 5, 3), C=(16, 7, 1). Which set is non-dominated?

(a) A, B, and C
(b) B and C
(c) A and C
(d) A only
### Question 35

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site generates a micro-segmentation policy. The simplified rule is: each IoT device may connect to each DMZ collector, and each OT controller has exactly one allowed engineering-workstation flow. No IT-to-IoT flows are allowed. IoT devices=27, OT controllers=6, DMZ collectors=3. How many allowed flows are generated?

(a) 114
(b) 87
(c) 36
(d) 81
### Question 36

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program verifies credential rotation. The rule is success only if old credential fails, new credential works, and Vault write succeeds. old_credential_fails=False, new_credential_works=True, vault_write_succeeds=False. Which result follows?

(a) rotation not verified
(b) rotation verified
(c) verified but do not store evidence
(d) rollback always required
### Question 37

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority monitors post-remediation health. The rollback rule is trigger rollback when error_rate > 0.05, latency_ms > 180, or critical_service_lost is true. error_rate=0.03, latency_ms=105, critical_service_lost=False. Which decision follows?

(a) trigger rollback
(b) approve new actions immediately
(c) ignore because only one metric failed
(d) continue monitoring
### Question 38

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility runs a self-healing policy check. The rule is drift_count = planned_rules - applied_rules, and self-healing is required when drift_count > 0. planned_rules=76, applied_rules=74. Which result follows?

(a) drift_count 76; self-healing required
(b) drift_count 2; no self-healing required
(c) drift_count 2; self-healing required
(d) drift_count -2; no self-healing required
### Question 39

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network checks whether an autonomous plan may enter execution. The rule is ready only if dependency_graph_valid, twin_preflight_pass, and approval_satisfied are all true. approval_satisfied is true automatically for non-manual actions and otherwise depends on approval. dependency_graph_valid=False, twin_preflight_pass=True, manual_required=False, approval_granted=not needed. Which readiness result follows?

(a) discard all findings
(b) not ready for execution
(c) ready for execution
(d) execute and skip health checks
### Question 40

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority computes remediation economics. The rule is total_cost = credential_rotations*0.5 + firmware_updates*2.0 + segmentation_policies*1.5 + config_changes*0.8. Risk reduction points are rotations*4 + firmware*9 + segmentation*6 + configs*2. Counts are rotations=8, firmware=2, segmentation=7, configs=8. Which cost and risk-reduction-to-cost ratio follow?

(a) cost 24.9; ratio 4.34
(b) cost 25.0; ratio 4.34
(c) cost 24.9; ratio 0.23
(d) cost 18.5; ratio 5.84
### Question 41

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator schedules a safe firmware wave. The rule is maintenance_windows = ceil(device_count / max_offline_at_once), and total_minutes = maintenance_windows * minutes_per_window. device_count=24, max_offline_at_once=8, minutes_per_window=40. Which schedule follows?

(a) No determinate answer can be computed from the stated rule.
(b) 8 windows; 320 minutes
(c) 24 windows; 960 minutes
(d) 3 windows; 120 minutes
### Question 42

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator applies the Chapter 12 safety gate. The rule is execute only if simulation_pass, postconditions_pass, approval_granted, and pre_execution_health_green are all true. simulation_pass=True, postconditions_pass=True, approval_granted=False, pre_execution_health_green=False. Which decision follows?

(a) execute with no rollback checkpoint
(b) delete the plan
(c) block execution
(d) execute
### Question 43

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant measures compliance delta with the score rule (passed + 0.5*partial)/13*100. Before remediation: passed=8, partial=3. After remediation: passed=11, partial=2. Which delta follows?

(a) before 92.3%; after 73.1%; delta -19.2 points
(b) before 73.1%; after 92.3%; delta 19.2 points
(c) before 73.1%; after 92.3%; delta 92.3 points
(d) before 61.5%; after 84.6%; delta 23.1 points
### Question 44

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network identifies non-dominated remediation actions. Each tuple is (risk_reduction, cost, downtime). An action is dominated if another action has risk_reduction >= it, cost <= it, downtime <= it, and at least one strict improvement. A=(14, 4, 3), B=(13, 5, 4), C=(16, 7, 2). Which set is non-dominated?

(a) A and C
(b) A only
(c) A, B, and C
(d) B and C
### Question 45

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program generates a micro-segmentation policy. The simplified rule is: each IoT device may connect to each DMZ collector, and each OT controller has exactly one allowed engineering-workstation flow. No IT-to-IoT flows are allowed. IoT devices=21, OT controllers=4, DMZ collectors=2. How many allowed flows are generated?

(a) 27
(b) 42
(c) 67
(d) 46
### Question 46

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative verifies credential rotation. The rule is success only if old credential fails, new credential works, and Vault write succeeds. old_credential_fails=True, new_credential_works=True, vault_write_succeeds=True. Which result follows?

(a) verified but do not store evidence
(b) rollback always required
(c) rotation verified
(d) rotation not verified
### Question 47

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site monitors post-remediation health. The rollback rule is trigger rollback when error_rate > 0.05, latency_ms > 180, or critical_service_lost is true. error_rate=0.06, latency_ms=205, critical_service_lost=False. Which decision follows?

(a) ignore because only one metric failed
(b) trigger rollback
(c) continue monitoring
(d) approve new actions immediately
### Question 48

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program runs a self-healing policy check. The rule is drift_count = planned_rules - applied_rules, and self-healing is required when drift_count > 0. planned_rules=34, applied_rules=34. Which result follows?

(a) drift_count 0; no self-healing required
(b) No determinate answer can be computed from the stated rule.
(c) drift_count 34; self-healing required
(d) drift_count 0; self-healing required
### Question 49

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority checks whether an autonomous plan may enter execution. The rule is ready only if dependency_graph_valid, twin_preflight_pass, and approval_satisfied are all true. approval_satisfied is true automatically for non-manual actions and otherwise depends on approval. dependency_graph_valid=True, twin_preflight_pass=True, manual_required=False, approval_granted=not needed. Which readiness result follows?

(a) not ready for execution
(b) execute and skip health checks
(c) discard all findings
(d) ready for execution
### Question 50

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility computes remediation economics. The rule is total_cost = credential_rotations*0.5 + firmware_updates*2.0 + segmentation_policies*1.5 + config_changes*0.8. Risk reduction points are rotations*4 + firmware*9 + segmentation*6 + configs*2. Counts are rotations=6, firmware=2, segmentation=9, configs=4. Which cost and risk-reduction-to-cost ratio follow?

(a) cost 23.7; ratio 0.23
(b) cost 20.5; ratio 5.07
(c) cost 23.7; ratio 4.39
(d) cost 21.0; ratio 4.39
