ISO 27001 ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In ISO/IEC 27001, what is the purpose of Annex A?

   • ATo define the certification requirements for auditors and certification bodies
   • BTo specify mandatory technical requirements for all information security products
   • CTo provide a catalogue of control objectives and controls that organizations can use as a reference when selecting controls for risk treatment
   • DTo provide a step-by-step guide for implementing an ISMS
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A water utility is preparing for its ISO 27001 certification audit. The internal audit identified that the SCADA system's backup procedures are not tested regularly, and the last test was 18 months ago. The certification body requires that all nonconformities be resolved before certification. The utility has limited resources and must decide how to address this nonconformity. What is the most appropriate action?

   • ARequest an extension from the certification body to address the nonconformity after certification.
   • BConduct a backup test immediately, document the results, and update the backup procedure to include regular testing.
   • CExclude the SCADA system from the ISMS scope to avoid the nonconformity.
   • DDocument the lack of testing as an accepted risk in the risk treatment plan.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   According to ISO/IEC 27001, which of the following is a key requirement for establishing an ISMS?

   • APurchasing and deploying a specific set of security software tools
   • BDefining the scope of the ISMS in terms of the organization's internal and external context
   • CImplementing all controls listed in Annex A without exception
   • DObtaining certification before implementing any security measures
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A regional gas distribution company is aligning its OT environment with ISO 27001. The risk assessment identified that the legacy SCADA system uses unencrypted Modbus TCP, and the risk of spoofing is high. The team is considering two options: (1) implementing a bump-in-the-wire encryption device, or (2) upgrading to a modern protocol with built-in security. The upgrade would require a full system outage and significant capital investment. The company's risk appetite is low, but operational continuity is critical. What is the MOST appropriate risk treatment decision?

   • AAccept the risk because the likelihood of an attack is low.
   • BProceed with the immediate upgrade to eliminate the risk entirely.
   • CImplement network monitoring to detect spoofing attempts without changing the protocol.
   • DImplement the bump-in-the-wire encryption device as a temporary measure while planning the upgrade.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A manufacturing company is preparing for ISO 27001 certification. The internal audit has been completed, and the management review is scheduled. The audit found that several OT devices have default passwords. The management team is debating whether to fix this before the certification audit. What is the BEST course of action?

   • APrioritize changing default passwords on all OT devices before the certification audit.
   • BArgue that default passwords are acceptable for legacy devices.
   • CExclude OT devices from the audit scope to avoid the finding.
   • DDocument the finding and plan to fix it after certification.
   Reveal Solution Discussion Select an answer first