ISO 27001 ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A nuclear research facility is implementing ISO 27001. The risk assessment team has identified a risk of unauthorized physical access to the control room. The facility has a strict safety culture, and any changes to the control room layout are heavily regulated. The team is considering controls: (1) installing biometric access control, (2) adding a security guard, or (3) implementing a two-person rule. Which control is MOST appropriate given the regulatory constraints?

   • AAdd a security guard at the entrance.
   • BAccept the risk because regulatory constraints prevent any changes.
   • CInstall biometric access control systems.
   • DImplement a two-person rule for access to the control room.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company has implemented an ISMS for its ICS environment and is preparing for ISO 27001 certification. The internal audit has been completed, and the audit team identified several non-conformities. What is the mandatory NEXT step in the certification process?

   • AConduct a management review to evaluate audit findings and decide on corrective actions.
   • BSubmit the audit report directly to the certification body for Stage 2 audit.
   • CImmediately implement corrective actions for all non-conformities without further review.
   • DUpdate the Statement of Applicability to reflect the audit findings.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small water utility wants to achieve ISO 27001 certification for its SCADA system. The management team is unsure about the scope of the ISMS. According to ISO 27001, what should the organization do to define the scope?

   • AInclude only the SCADA system and exclude all other IT systems.
   • BDocument the scope considering internal and external issues, interested parties, and interfaces with other systems.
   • CInclude all systems in the organization to simplify certification.
   • DDefine the scope based on the certification body's recommendations.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A petrochemical company is implementing ISO 27001 for its refinery control systems. The risk assessment identified that the safety instrumented system (SIS) has a critical vulnerability that could allow an attacker to disable safety shutdown functions. The SIS vendor has released a patch, but applying it requires a full plant shutdown, which would cost $2 million in lost production. The company's risk acceptance criteria state that risks with a potential impact on human safety cannot be accepted. What is the most appropriate risk treatment decision?

   • AApply the patch immediately, regardless of the production loss, because human safety is at risk.
   • BTransfer the risk to the SIS vendor by requiring them to provide a warranty against any safety incidents.
   • CApply compensating controls, such as network segmentation and enhanced monitoring, while scheduling the patch during the next planned shutdown.
   • DAccept the risk because the likelihood of an attack is low, despite the safety impact.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In the ISO/IEC 27001 risk management process, what is the purpose of risk identification?

   • ATo identify assets, threats, vulnerabilities, and potential impacts that could affect the confidentiality, integrity, or availability of information
   • BTo select and implement appropriate controls to reduce risk to an acceptable level
   • CTo determine the level of risk by comparing risk criteria against the likelihood and impact of each risk
   • DTo decide which risks require treatment and to prioritize them for action
   Reveal Solution Discussion Select an answer first