ISO 27001 ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a specific security consideration when applying ISO/IEC 27001 to ICS/SCADA systems?

   • AUsing the same risk assessment criteria as for corporate IT without adjustment
   • BIgnoring the physical security of control system components because they are in secure facilities
   • CPrioritizing the availability and integrity of control processes over typical IT confidentiality requirements
   • DApplying the same patch management schedule as corporate IT systems without modification
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A nuclear power plant is implementing ISO 27001 and has identified that its control room workstations are connected to the corporate network for monitoring purposes. The security team is reviewing Annex A controls and must address the risk of malware being introduced from the corporate network. The plant has strict regulatory requirements that limit the use of encryption and require that all changes be approved by a safety committee. Which Annex A control is most appropriate to address this risk?

   • ACryptographic controls (A.10) to encrypt all traffic between the control room and corporate network.
   • BCompliance (A.18) to ensure the plant meets regulatory requirements.
   • CSupplier relationships (A.15) to ensure the corporate network vendor secures the connection.
   • DNetwork segregation (A.13.1) to separate the control room workstations from the corporate network.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A transportation company is implementing ISO 27001 for its railway signaling system. The risk assessment identified that the signaling system uses a legacy protocol that is vulnerable to spoofing. The team is considering two treatment options: (1) upgrade the protocol, which is expensive and requires a full system outage, or (2) implement network monitoring to detect spoofing attempts. The company has a limited budget and cannot afford both. What is the most appropriate decision according to ISO 27001?

   • AAccept the risk without any treatment because the likelihood of an attack is low.
   • BTransfer the risk to the signaling system vendor by requiring them to fix the protocol.
   • CImplement network monitoring as a compensating control and document the residual risk, with a plan to upgrade the protocol in the future.
   • DUpgrade the protocol immediately, even if it exceeds the budget, because the risk is too high.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A chemical plant is integrating its OT environment into an ISO 27001-compliant ISMS. The team is mapping Annex A controls to the ICS environment. Which control implementation is MOST appropriate for the unique characteristics of the OT network?

   • AApplying the same password policy to all OT devices, including legacy PLCs.
   • BEncrypting all OT network traffic without exception.
   • CDisabling all USB ports on engineering workstations to prevent malware.
   • DImplementing network segmentation between IT and OT zones with strict firewall rules.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A food processing company is implementing an ISMS and has defined its scope, policy, and risk assessment process. The team is now working on the Statement of Applicability (SoA). What is the PRIMARY purpose of the SoA?

   • ATo provide a summary of the internal audit results.
   • BTo document which Annex A controls are applicable and justify any exclusions.
   • CTo list all assets and their owners within the ISMS scope.
   • DTo describe the risk assessment methodology used by the organization.
   Reveal Solution Discussion Select an answer first