Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A utility has an ICS security policy that has not been updated in three years. The plant has undergone significant changes, including new equipment and network connections. The security manager is concerned about compliance. What is the most appropriate action?

   • AConduct an unscheduled review of the policy to incorporate the changes and update it accordingly.
   • BArchive the old policy and operate without a policy until a new one is written.
   • CCreate a new policy from scratch to replace the old one.
   • DWait for the next scheduled annual review to update the policy.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An engineering firm is designing a new ICS for a client and must ensure it meets security requirements. They are considering using ISA/IEC 62443 to guide the design. Which approach best leverages the standard?

   • ADefine security zones and conduits, then assign target security levels based on risk assessment.
   • BUse only the component-level requirements from Part 4-2 without considering system-level requirements.
   • CFollow ISO 27001 controls instead of 62443 because it is more comprehensive.
   • DApply the same security level to all components to ensure consistency.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security manager is selecting controls from ISO/IEC 27002 for a SCADA environment. Which control category is most critical to address first to protect the ICS network?

   • AHuman resource security
   • BAccess control
   • CNetwork security controls
   • DPhysical security
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A utility company is implementing ISO/IEC 27001 and plans to use ISA/IEC 62443 as a reference for technical controls. During an internal audit, the auditor asks how the organization ensures that security controls do not interfere with the reliability of the power grid. Which response BEST demonstrates alignment with both standards?

   • AThe organization has implemented all ISO 27001 controls without modification to ensure consistency with the standard.
   • BThe organization has documented that availability and safety are prioritized over confidentiality in the ICS risk treatment plan.
   • CThe organization has classified all ICS data as confidential and applied the highest level of encryption to all communications.
   • DThe organization has outsourced all security monitoring to a third-party provider to reduce the burden on internal staff.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a governance process for an ICS security policy?

   • ATo replace the need for security awareness training
   • BTo design the technical architecture of the ICS network
   • CTo automate all security controls
   • DTo ensure the policy is approved, reviewed, and enforced consistently
   Reveal Solution Discussion Select an answer first