Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A water utility is implementing ISO/IEC 27001 and needs to apply its controls to the SCADA network. The security team notes that the SCADA environment uses legacy protocols and has strict availability requirements. Which approach best aligns ISO 27001 controls with the ICS environment?

   • ASelect and tailor controls from ISO/IEC 27002, considering the safety and availability priorities of the SCADA environment.
   • BReplace ISO 27001 controls with ISA/IEC 62443 requirements to address all ICS security needs.
   • CApply the same IT-focused controls to all systems, including the SCADA network, to ensure consistency.
   • DImplement only the mandatory controls from ISO 27002 without modification to meet compliance.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a key compliance requirement when implementing ISO-based policies in ICS/SCADA environments?

   • AOnly internal policies need to be considered
   • BCompliance with ISO/IEC 27001 is sufficient for all legal requirements
   • CAdherence to industry-specific regulations such as NERC CIP for power utilities
   • DCompliance is optional for ICS/SCADA systems
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization operating a natural gas pipeline is preparing for an ISO/IEC 27001 certification audit. The auditor will review the ICS security program. Which audit consideration is UNIQUE to ICS/SCADA environments compared to traditional IT audits?

   • AVerifying that safety instrumented systems (SIS) are not adversely affected by security monitoring or testing activities.
   • BConfirming that all user accounts have strong passwords and multi-factor authentication is enabled.
   • CChecking that the firewall rules are reviewed and updated on a regular schedule.
   • DReviewing the organization's data backup and recovery procedures for all servers.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which statement best describes the structure of ISO/IEC 27001?

   • AIt is a technical standard that specifies network architecture and firewall rules for securing industrial networks.
   • BIt is a framework that includes requirements for an ISMS and an annex of control objectives and controls that can be selected based on risk assessment.
   • CIt is a set of guidelines for implementing specific security software products.
   • DIt is a checklist of mandatory security controls that all organizations must implement.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A power generation company is writing an ICS security policy based on ISO/IEC 27001. The policy must be enforceable and practical for both IT and OT staff. Which component is ESSENTIAL for the policy document to be effective in this environment?

   • AA list of specific security software products that must be installed on all OT workstations.
   • BA clear statement of management commitment and defined roles and responsibilities for ICS security.
   • CA detailed list of every hardware model and firmware version used in the ICS environment.
   • DA commitment to achieve 100% uptime for all ICS systems to ensure production continuity.
   Reveal Solution Discussion Select an answer first