Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A renewable energy company is implementing ISO/IEC 27001 and using ISA/IEC 62443 for its wind farm SCADA systems. The SCADA systems are distributed across multiple remote locations. The company wants to implement strong authentication for all remote access. However, some remote sites have intermittent connectivity, and operators need to access the systems quickly during emergencies. What is the BEST authentication approach?

   • AImplement multi-factor authentication (MFA) with a fallback mechanism for emergency access when the primary method is unavailable.
   • BRequire MFA for all access, including emergencies, to ensure consistent security.
   • CDisable remote access entirely and require operators to be physically present at each site.
   • DUse simple password authentication for all remote access to avoid delays during emergencies.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A chemical plant is developing a roadmap to implement an ISO/IEC 27001-based ICS security policy. The plant has multiple sites with different levels of maturity. The security manager needs to ensure the roadmap is realistic and achievable. Which approach BEST supports this goal?

   • ADefer the roadmap until all sites have achieved the same level of security maturity.
   • BPrioritize actions based on risk and implement them in phases, starting with the highest-risk sites and systems.
   • CImplement all required controls simultaneously across all sites to achieve compliance as quickly as possible.
   • DFocus only on the corporate IT network first, then extend the policy to OT networks in a later phase.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which ISO/IEC 27002 control category is most directly relevant to managing access to ICS/SCADA systems?

   • APhysical and environmental security
   • BCryptography
   • CAccess control
   • DSupplier relationships
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When applying ISO/IEC 27001 to an ICS/SCADA environment, what is a key difference from traditional IT that must be considered?

   • AICS/SCADA systems are not exposed to cyber threats.
   • BICS/SCADA systems often prioritize availability and safety over confidentiality.
   • CICS/SCADA systems do not require risk assessments.
   • DISO/IEC 27001 is not applicable to ICS/SCADA because it is an IT standard.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A food processing company is developing a roadmap to implement an ISO-based ICS security policy. They have completed the gap analysis and identified critical gaps. What should they do next?

   • AUpdate the company's IT security policy to include ICS-specific language.
   • BImmediately implement all identified controls to close the gaps as quickly as possible.
   • CSchedule an external certification audit to validate the gaps.
   • DDevelop a prioritized remediation plan based on risk and impact to ICS operations.
   Reveal Solution Discussion Select an answer first