ISO 27001 ICSSCADA Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   A water utility is implementing ISO 27001 and has identified that its SCADA system uses a mix of modern and legacy devices. The team is mapping Annex A controls and finds that the legacy devices do not support encryption or strong authentication. The risk assessment shows a high risk of unauthorized access. What is the MOST appropriate approach to address this risk?

   • ADocument the risk as accepted without implementing any controls.
   • BImplement compensating controls, such as network segmentation and strict access control lists, to protect legacy devices.
   • CExclude legacy devices from the ISMS scope to avoid non-compliance.
   • DReplace all legacy devices with modern ones to ensure full compliance with Annex A controls.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A manufacturing company is conducting a risk assessment for its robotic assembly line. The team has identified that a failure in the network switch could stop the entire production line. The likelihood is low, but the impact is very high. The company has decided to install a redundant switch. In ISO 27001 terms, what type of risk treatment is this?

   • ARisk mitigation by reducing the likelihood of the failure.
   • BRisk avoidance by eliminating the network switch.
   • CRisk transfer by shifting the risk to the switch vendor.
   • DRisk acceptance because the likelihood is low.
   Reveal Solution Discussion Select an answer first