ISO 27001 ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A logistics company has implemented an ISMS and is preparing for the Stage 1 certification audit. The certification body has requested documentation. Which document is MOST critical for the Stage 1 audit?

   • AThe business continuity plan and incident response procedures.
   • BThe internal audit schedule and training records.
   • CThe asset inventory and network diagrams.
   • DThe Statement of Applicability (SoA) and the risk treatment plan.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a requirement for maintaining and improving an ISMS according to ISO/IEC 27001?

   • APerforming a risk assessment only once during the initial implementation
   • BConducting internal audits at planned intervals
   • CEnsuring that all employees have the same level of security training
   • DDocumenting all security incidents in a public log
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A pipeline operator is conducting an ISO 27001 risk assessment for its SCADA system. The team has identified a risk of unauthorized access to the HMI through the corporate network. They have analyzed the likelihood and impact and determined the risk level. What is the NEXT step in the risk management process?

   • AEvaluate the risk against the risk acceptance criteria to decide if treatment is required.
   • BImplement a firewall between the corporate and SCADA networks immediately.
   • CConsult with the certification body on how to handle the risk.
   • DDocument the risk in the risk register and move to the next risk.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the role of an internal audit in the ISO/IEC 27001 certification process?

   • ATo evaluate the ISMS's conformity to the standard and its effectiveness before the external certification audit
   • BTo approve the organization's risk treatment plan
   • CTo issue the ISO/IEC 27001 certificate to the organization
   • DTo replace the external certification audit entirely
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A food and beverage company is implementing ISO 27001 for its bottling plant. The risk assessment identified that the plant's programmable logic controllers (PLCs) are vulnerable to unauthorized access because they use default credentials. The company has a policy that requires all systems to use strong authentication. However, the PLCs do not support strong authentication, and replacing them would be very expensive. What is the most appropriate risk treatment decision?

   • AImplement compensating controls, such as network segmentation and monitoring, and document the residual risk.
   • BAccept the risk because the PLCs are not connected to the internet.
   • CTransfer the risk to the PLC vendor by requiring them to provide a security update.
   • DReplace all PLCs immediately to comply with the strong authentication policy.
   Reveal Solution Discussion Select an answer first