Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A defense contractor is implementing ISO/IEC 27001 and needs to select controls from ISO/IEC 27002 for its manufacturing ICS. The contractor handles classified information and must comply with government security regulations. The ICS is air-gapped from the corporate network. The security team is debating which controls to prioritize. Which control selection BEST addresses the unique requirements of this environment?

   • APrioritize physical and environmental security controls to protect the air-gapped ICS from unauthorized physical access.
   • BPrioritize cryptographic controls to protect data at rest on the ICS systems.
   • CPrioritize supplier relationship controls since the contractor relies on external vendors for ICS maintenance.
   • DPrioritize network security controls such as firewalls and IDS since the system is air-gapped.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security architect is mapping ISO 27001 controls to an ICS environment that includes both IT and OT systems. They notice that some ISO 27002 controls conflict with ISA/IEC 62443 recommendations. What is the best way to resolve these conflicts?

   • AUse a risk assessment to determine which control is more appropriate for each specific asset and document the rationale.
   • BImplement both sets of controls fully to ensure complete coverage.
   • CFollow ISA/IEC 62443 recommendations because they are specific to ICS.
   • DFollow ISO 27001 controls because they are mandatory for certification.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A large utility is updating its ICS security policy. The operations team demands that any new policy must not interfere with real-time control, while the security team insists on strict access controls. The policy must be approved by both teams. What is the best approach to reconcile these conflicting requirements?

   • AImplement the security team's requirements and require operations to comply without exceptions.
   • BDevelop a policy with a risk-based approach that defines different access control levels for different zones, with an exception process for real-time systems.
   • CLet the operations team define the policy without security input to avoid conflicts.
   • DCreate a single policy that applies the same access control rules to all systems, including real-time control.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is an example of an ISO/IEC 27002 control that is particularly important for ICS/SCADA environments?

   • ASoftware licensing compliance
   • BTax reporting procedures
   • CMarketing communication review
   • DChange management procedures
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An engineering firm is designing a new ICS for a client and wants to ensure that the security requirements are integrated into the system design from the start. The client also requires compliance with ISO/IEC 27001. Which approach BEST aligns with both ISO 27001 and ISA/IEC 62443?

   • AConduct a security risk assessment during the design phase and define zones and conduits based on the results.
   • BDefer all security considerations until the system is fully deployed and operational.
   • CImplement a flat network with no segmentation to simplify management and reduce costs.
   • DFocus only on ISO 27001 compliance and ignore IEC 62443 since the client only mentioned ISO.
   Reveal Solution Discussion Select an answer first