Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which part of the ISA/IEC 62443 series provides common terminology and concepts used throughout the standard?

   • APart 4-2: Technical security requirements for IACS components
   • BPart 2-1: Security program requirements for IACS asset owners
   • CPart 3-3: System security requirements and security levels
   • DPart 1-1: Concepts and models
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An energy company is drafting an ICS security policy document. Which component is essential to include to ensure the policy is enforceable and maintained?

   • AA statement of management commitment, roles and responsibilities, and a review schedule.
   • BA detailed network diagram of the ICS architecture.
   • CA list of all vendor product manuals and technical documentation.
   • DThe names of all employees with access to the SCADA system.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A utility company has drafted an ICS security policy. To ensure it remains effective, what governance process should be established?

   • AAnnual review by the IT department only.
   • BA periodic review cycle with defined triggers for unscheduled updates.
   • CA one-time approval by the CEO with no further reviews.
   • DReview only when a security incident occurs.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A mining company is developing an ICS security roadmap based on ISO/IEC 27001 and ISA/IEC 62443. The company has multiple remote sites with limited connectivity and no on-site IT staff. The roadmap must be implemented over three years with a limited budget. Which strategy BEST balances security improvement with operational constraints?

   • ADelay the roadmap until all sites have reliable high-speed internet connectivity.
   • BDeploy full security stacks at each remote site to ensure complete protection locally.
   • CFocus all security efforts on the corporate office and treat remote sites as low-risk due to their isolation.
   • DImplement a centralized security monitoring solution at the corporate office and deploy lightweight agents at remote sites.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A pipeline operator is preparing for an ISO/IEC 27001 certification audit of its ICS environment. What is a key audit consideration specific to ICS/SCADA?

   • AThe audit should verify that safety and availability are prioritized in control implementation, even if some IT controls are not fully applied.
   • BAuditors must ensure that all ICS devices are replaced with the latest models before certification.
   • CThe audit should focus exclusively on the corporate IT network because ICS systems are out of scope.
   • DThe audit must be conducted without any interaction with the ICS network to avoid disruption.
   Reveal Solution Discussion Select an answer first