ISO 27001 ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a control category in Annex A of ISO/IEC 27001?

   • ANetwork controls
   • BData controls
   • CSoftware controls
   • DOrganizational controls
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An oil and gas company is conducting a risk assessment for its pipeline control system as part of ISO 27001 implementation. The team has identified a risk where a remote attacker could exploit a vulnerability in the human-machine interface (HMI) software to alter pipeline pressure settings. The likelihood is rated as medium and the impact as high. According to ISO 27001 risk assessment methodology, what should the team do next?

   • AEvaluate the risk level against the established risk acceptance criteria to determine if treatment is required.
   • BDocument the risk in the risk register and move on to the next risk without further analysis.
   • CTransfer the risk to an insurance provider without evaluating the risk level.
   • DImmediately implement a firewall between the corporate network and the control system network.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   According to ISO/IEC 27001, which of the following is a valid risk treatment option?

   • ARisk duplication
   • BRisk elimination
   • CRisk avoidance
   • DRisk amplification
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A chemical plant is implementing ISO 27001 and has identified that its distributed control system (DCS) uses a proprietary protocol that is not encrypted. The risk assessment shows that an attacker could intercept and modify control commands. The team is considering controls from Annex A. Which control from Annex A is most directly applicable to address this risk?

   • ACompliance (A.18) to ensure the plant meets regulatory requirements.
   • BCryptographic controls (A.10) to protect the confidentiality and integrity of the control commands.
   • CPhysical security (A.11) to prevent unauthorized access to the plant floor.
   • DSupplier relationships (A.15) to ensure the DCS vendor patches the protocol.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A logistics company is implementing ISO 27001 and has established its ISMS. The management team is reviewing the ISMS performance and has identified that the risk assessment has not been updated since the initial implementation. According to ISO 27001, what is the most appropriate action?

   • AExclude the risk assessment from the ISMS scope.
   • BDocument the lack of updates as an accepted risk.
   • CConduct a new risk assessment to reflect changes in the organization and its environment.
   • DWait for the next certification audit to update the risk assessment.
   Reveal Solution Discussion Select an answer first