NERC CIP ICSSCADA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the purpose of security event monitoring under NERC CIP?

   • ATo detect and alert on potential cyber security incidents
   • BTo track employee productivity and internet usage
   • CTo collect performance metrics for system optimization
   • DTo ensure compliance with data retention laws
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   In the NERC CIP numbering system, what does the '5' in CIP-005-6 represent?

   • AThe version number of the standard
   • BThe year the standard was issued
   • CThe number of requirements in the standard
   • DThe standard number within the CIP family
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary purpose of the NERC CIP standards?

   • ATo regulate the retail electricity market and set consumer electricity rates
   • BTo provide voluntary cybersecurity guidelines for small renewable energy producers
   • CTo ensure the reliability of the bulk electric system by protecting cyber assets critical to its operation
   • DTo enforce international cybersecurity standards on all energy companies worldwide
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A utility is designing the physical security for a new substation that will contain Critical Cyber Assets. The substation is in a remote area with no on-site personnel. The design includes a fence, a locked gate, and a camera system. What additional physical security control is most directly required by NERC CIP for this type of facility?

   • AA physical access control system (PACS) that logs all entries and exits.
   • BA second fence to create a buffer zone.
   • CA security guard stationed at the gate 24/7.
   • DA sign indicating that the area is under video surveillance.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A utility is implementing NERC CIP's systems security management requirements. The security team is configuring a security information and event management (SIEM) system to collect logs from all Critical Cyber Assets. The team is debating how long to retain the logs. The NERC CIP requirement specifies a minimum retention period, but the team is considering a longer retention period for forensic purposes. What is the most appropriate approach?

   • ARetain logs for a period that exceeds the NERC CIP minimum, as this provides better forensic capability and is not prohibited by the standard.
   • BRetain logs only for the period that is operationally necessary, as NERC CIP does not mandate a specific retention period.
   • CRetain logs indefinitely, as this is the most secure approach.
   • DRetain logs for the minimum period required by NERC CIP to minimize storage costs.
   Reveal Solution Discussion Select an answer first