NERC CIP ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A utility is developing its NERC CIP cyber security policy. The compliance team wants to ensure the policy is enforceable and auditable. They have drafted a policy that includes roles and responsibilities, but they have not yet defined how employees with access to Critical Cyber Assets (CCAs) will be vetted. Which addition is most directly required to align with CIP-004?

   • AA personnel risk assessment process that includes a background check before granting access to CCAs
   • BAn incident response plan that includes a communication tree
   • CA physical access control list for the substation where the CCAs are located
   • DA patch management schedule for all CCA operating systems
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How are NERC CIP standards organized internally?

   • AInto requirements, each with specific measures and evidence needed for compliance
   • BInto chapters based on the type of cyber asset being protected
   • CInto appendices that list all approved vendors and products
   • DInto sections that correspond to different regulatory jurisdictions
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A utility has experienced a cyber security incident that affected a Critical Cyber Asset. The incident was contained, and the utility has completed its internal investigation. The utility has determined that the incident was caused by a phishing email that led to the compromise of a workstation with access to the control network. The utility is now preparing its report to the relevant authorities. What is the most important element to include in the report?

   • AA list of all personnel who were involved in the incident response.
   • BA description of the incident's impact on the reliable operation of the BES and the corrective actions taken.
   • CA proposal for new security technologies to prevent future incidents.
   • DA detailed technical analysis of the malware used in the attack.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of a recovery plan under NERC CIP?

   • ATo document the chain of custody for forensic evidence
   • BTo prevent all cyber security incidents from occurring
   • CTo restore Critical Cyber Assets to a secure state after a disruption
   • DTo provide a legal defense in case of a security breach
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A utility is upgrading the physical security at a control center that houses Critical Cyber Assets. The current system uses a simple keypad for door access. The utility wants to implement a more robust system that provides an audit trail. The budget is limited, and the utility is considering two options: a proximity card system with a central logging system, or a biometric system with local logging. The control center is staffed 24/7, and the security team is concerned about the reliability of the logging system. What is the most important factor in choosing between these two systems?

   • AThe cost of the system, as the utility has a limited budget.
   • BThe aesthetic appearance of the system, as it will be visible in the control center.
   • CThe ability of the system to provide a reliable and tamper-resistant audit trail of all access attempts.
   • DThe speed of access, as the control center is staffed and personnel need to move quickly.
   Reveal Solution Discussion Select an answer first