ISO 27001 ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of the ISO/IEC 27001 standard?

   • ATo provide a framework for establishing, implementing, maintaining, and continually improving an information security management system
   • BTo mandate the use of specific security technologies such as firewalls and intrusion detection systems
   • CTo define specific technical controls for protecting industrial control systems from cyber threats
   • DTo certify individual security products and software for compliance with international security standards
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large transportation authority has implemented an ISMS for its traffic control systems. During the Stage 2 certification audit, the auditor finds that the internal audit team did not audit the OT network segment due to safety concerns. The auditor issues a major non-conformity. What is the MOST appropriate corrective action?

   • ARequest the certification body to waive the requirement for OT auditing.
   • BExclude the OT network from the ISMS scope to avoid future non-conformities.
   • CConduct a remote audit of the OT network using screen sharing.
   • DDevelop a risk-based internal audit plan that includes OT systems, with safety measures in place.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A manufacturing company is aligning its OT environment with ISO 27001. The security team is reviewing Annex A controls and needs to select controls that specifically address the risk of unauthorized changes to PLC program logic. Which combination of Annex A control categories is most directly relevant to this risk?

   • AHuman resource security (A.7), physical security (A.11), and supplier relationships (A.15)
   • BAccess control (A.9), operations security (A.12), and system acquisition, development, and maintenance (A.14)
   • COrganization of information security (A.6), communications security (A.13), and compliance (A.18)
   • DAsset management (A.8), cryptography (A.10), and business continuity (A.17)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A regional water utility is implementing ISO 27001 and has defined its ISMS scope to include the SCADA network that controls water treatment. During the risk assessment, the team identifies that a legacy PLC on the plant floor has no authentication mechanism and is directly accessible from the corporate IT network. According to ISO 27001 requirements, what must the utility do as part of the risk treatment process?

   • AReplace the PLC immediately with a modern device that supports authentication, regardless of cost or operational impact.
   • BDocument the risk in the Statement of Applicability and accept it without further action because legacy systems are exempt from ISO 27001 controls.
   • CImmediately disconnect the PLC from the network and document this as the only acceptable treatment option.
   • DApply a risk treatment plan that selects controls from Annex A, such as network segregation and access control, to reduce the risk to an acceptable level.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A manufacturing company is undergoing its ISO 27001 certification audit. During the audit, the auditor finds that the company's incident response plan for the OT environment has not been tested in the past two years. The company argues that testing the plan would require a production shutdown, which is not feasible. The auditor issues a major nonconformity. What is the most appropriate action for the company to take?

   • AAccept the nonconformity and address it after certification.
   • BConduct a tabletop exercise to test the incident response plan without affecting production, and document the results.
   • CExclude the incident response plan from the ISMS scope.
   • DAppeal the nonconformity because testing the plan is not feasible.
   Reveal Solution Discussion Select an answer first