NERC CIP ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A BES entity has a Critical Cyber Asset (CCA) that runs a proprietary operating system. The vendor provides patches, but the entity is concerned that applying patches may disrupt grid operations. The entity wants to comply with CIP-007 while minimizing operational risk. What is the most appropriate approach?

   • AApply the patch immediately without testing to ensure compliance
   • BDo not apply the patch because it may disrupt operations
   • CApply the patch only if the vendor provides a warranty
   • DTest the patch in a non-production environment, then apply it during a scheduled maintenance window
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the required frequency for testing recovery plans under NERC CIP?

   • AAnnually
   • BAt least once every 15 months
   • CEvery 3 years
   • DOnly after a major incident
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A BES entity is considering whether to outsource the monitoring of its Critical Cyber Assets (CCAs) to a third-party vendor. The vendor will have remote access to the CCAs. The entity wants to ensure compliance with NERC CIP. Which consideration is most important?

   • AThe entity remains responsible for compliance, and the vendor must comply with the entity's CIP policies and procedures
   • BThe entity can transfer all compliance responsibility to the vendor
   • CThe vendor must register with NERC as a functional entity
   • DThe vendor is exempt from NERC CIP because it is a third party
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small generation facility that is part of the bulk electric system is evaluating its compliance obligations. The facility has a single turbine and a control system that is not connected to any external network. The facility's owner is unsure if NERC CIP applies. What is the primary factor that determines whether this facility must comply with NERC CIP?

   • AThe facility's annual revenue and whether it exceeds a certain threshold.
   • BThe facility's registration with NERC as a functional entity and its classification as a generator owner or operator.
   • CThe facility's age and whether it was built before or after the NERC CIP standards were established.
   • DThe facility's physical location and whether it is in a region with high cyber threat activity.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A reliability coordinator is updating its Critical Cyber Asset (CCA) identification process for a 500 kV substation. The substation has a protective relay that communicates with a remote engineering workstation via a routable protocol. The relay also has a local serial port used only for maintenance. During the assessment, the team determines the relay is essential to the reliable operation of the Bulk Electric System (BES). Which asset should be registered as a Critical Cyber Asset?

   • AThe protective relay, because it is essential to BES reliability and communicates using a routable protocol
   • BBoth the relay and the workstation, because they are in the same substation
   • CThe engineering workstation, because it is used for remote access to the relay
   • DThe serial port on the relay, because it provides a maintenance interface
   Reveal Solution Discussion Select an answer first