CRISC Information Technology and Security Practice Question
An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?
⚠ Common exam trap
A common pitfall is misunderstanding that 'security levels' (SL) in IEC 62443 are indeed a key requirement—they define the target security capability for each zone/conduit (SL 1-4). The trap is that some candidates may view SL as merely a classification rather than an actionable requirement, but the standard mandates implementing appropriate SLs for each zone. Option B (mandatory cloud backup) and D (AES-256 encryption) are not explicit requirements of IEC 62443, while annual external testing (C) may be recommended but is not a key requirement like zones/conduits and SLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Segmentation of networks into zones and conduits
IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Segmentation of networks into zones and conduits
Why this is correct
Defense-in-depth zones and conduits are core concepts.
- ✗
Mandatory cloud-based backup for all control systems
Why it's wrong here
Cloud backup is not required by IEC 62443.
- ✗
Annual penetration testing by an external firm
Why it's wrong here
Testing is recommended but not a specific requirement of the standard.
- ✗
Use of AES-256 encryption for all communications
Why it's wrong here
The standard does not specify particular encryption algorithms.
- ✓
Implementation of security levels (SL) for control systems
Why this is correct
IEC 62443 defines SLs to categorize required security robustness.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.