Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A water treatment facility is selecting ISO/IEC 27002 controls to protect its SCADA system. The facility has a small IT team and limited budget. Which control category should be prioritized to reduce the risk of unauthorized remote access to the SCADA network?

   • APhysical and environmental security (A.11) including secure areas and equipment protection.
   • BCryptography (A.10) including encryption of data in transit.
   • CSupplier relationships (A.15) including security in supplier agreements.
   • DAccess control (A.9) including network access control and user access management.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A regional water authority is implementing ISO/IEC 27001 and must comply with local regulations that require protection of critical infrastructure. What is the best way to address compliance in the ISMS?

   • AIgnore local regulations because ISO 27001 is an international standard that overrides them.
   • BWait for the external auditor to identify all compliance requirements.
   • CUse only ISA/IEC 62443 to meet local regulations, as it is more specific.
   • DIncorporate local regulatory requirements into the risk assessment and control selection process.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An organization's ICS is subject to both ISO 27001 certification and a regional regulatory audit. The regulatory auditor requires evidence of specific technical controls, while the ISO auditor focuses on the ISMS process. How should the organization prepare to satisfy both?

   • AMaintain a single set of ISMS documentation that includes both process and technical control evidence.
   • BPrepare separate documentation for each auditor to avoid confusion.
   • CFocus only on the regulatory audit because it is legally required.
   • DAsk the ISO auditor to also perform the regulatory audit.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A food and beverage company is mapping ISO/IEC 27001 controls to its ICS environment. The team is reviewing the access control policy (Annex A.9). Which adaptation is MOST appropriate for the ICS environment?

   • ARequire all ICS users to use smart card authentication for every login, including emergency shutdown procedures.
   • BGrant all operators full administrative rights to the HMI systems to ensure they can respond to any situation.
   • CApply the same password policy and account lockout settings to all HMIs and engineering workstations.
   • DImplement role-based access control with segregation of duties for engineering and operations staff.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A hospital network is implementing ISO/IEC 27001 for its building management system (BMS) that controls HVAC, lighting, and access control. The BMS is connected to the hospital's IT network for monitoring. The hospital must comply with patient data regulations and ensure that the BMS does not compromise patient safety. During an audit, the auditor questions whether the BMS security controls are adequate. What is the BEST way to address this concern?

   • AExplain that the BMS is a low-risk system and does not require the same level of security as patient data systems.
   • BDemonstrate that the BMS has been included in the ISMS scope and that a risk assessment has been conducted specifically for it.
   • CState that the BMS is managed by a third-party vendor and is therefore outside the organization's responsibility.
   • DDisconnect the BMS from the IT network to eliminate all security risks.
   Reveal Solution Discussion Select an answer first