ISO 27001 ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A utility company is preparing for its ISO 27001 surveillance audit. The internal audit team has identified that some employees in the SCADA control room have not completed the annual security awareness training. According to ISO 27001, what is the most appropriate action to take before the surveillance audit?

   • AEnsure the training is completed and document the completion records as evidence of compliance.
   • BDocument the training gap as an accepted risk in the risk treatment plan.
   • CWait for the surveillance audit and address the training gap during the audit.
   • DExclude the control room employees from the ISMS scope to avoid the nonconformity.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A water treatment facility is implementing ISO 27001 and has identified that a legacy PLC on the OT network has no vendor support and cannot be patched. The risk assessment shows a high likelihood of exploitation and a high impact on water quality monitoring. The facility has already implemented compensating network segmentation and monitoring. What should the ISMS implementation team do NEXT to align with ISO 27001 requirements?

   • ADisconnect the PLC from the network to eliminate the risk without further analysis.
   • BImmediately replace the legacy PLC with a modern, supported model to eliminate the risk entirely.
   • CApply a risk mitigation plan that includes only technical controls, such as additional firewalls.
   • DFormally document the risk treatment decision, including the acceptance of residual risk by the appropriate management level.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A power generation company has completed the implementation of its ISMS and is preparing for ISO 27001 certification. The internal audit has been conducted and nonconformities were found in the incident management process for the SCADA control center. According to ISO 27001 certification requirements, what must the company do before the certification audit can proceed?

   • AProceed with the certification audit and address the nonconformities after certification is granted.
   • BRequest that the certification body waive the nonconformities because they are in the OT environment and not in the corporate IT network.
   • CImplement corrective actions for the nonconformities, verify their effectiveness, and update relevant ISMS documentation.
   • DUpdate the Statement of Applicability to exclude the incident management process for the SCADA control center.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following best describes the scope of ISO/IEC 27001?

   • AIt applies only to organizations with more than 500 employees
   • BIt applies only to government agencies and public sector organizations
   • CIt applies only to organizations in the information technology and telecommunications sectors
   • DIt applies to all types of organizations, regardless of size, industry, or sector
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a step in the ISO/IEC 27001 certification process?

   • AStage 1 audit to review the organization's readiness and documentation
   • BImplementing all Annex A controls to pass the audit
   • CObtaining approval from a government regulatory body
   • DPublishing the organization's security policies on a public website
   Reveal Solution Discussion Select an answer first