NERC CIP ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of an incident response plan under NERC CIP?

   • ATo assign blame for security failures
   • BTo document all past incidents for regulatory review
   • CTo replace the need for cyber security training
   • DTo provide a structured approach for responding to and recovering from cyber security incidents
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a Critical Cyber Asset (CCA) as defined by NERC CIP?

   • AA laptop used by an engineer to access the corporate network
   • BA weather monitoring station that provides data for forecasting
   • CA control system that manages a generator's output to maintain grid frequency
   • DA corporate email server used for administrative communication
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A utility's patch management team is planning to apply a critical security patch to a Windows-based human-machine interface (HMI) that is identified as a Critical Cyber Asset. The patch is known to require a reboot. The HMI is currently in use and cannot be taken offline during business hours. What is the most appropriate action to maintain compliance with NERC CIP's systems security management requirements?

   • ADefer the patch indefinitely until the next scheduled maintenance window.
   • BSchedule the patch application during a planned maintenance window and document the change in the change management process.
   • CApply the patch to a test system first, then to the production HMI without a specific time frame.
   • DApply the patch immediately, as the security risk outweighs the operational impact.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A utility has a recovery plan for its Critical Cyber Assets (CCAs) that was last tested 18 months ago. The compliance team is preparing for an audit and wants to ensure the plan meets CIP-009. What is the most appropriate action?

   • AArchive the old test results and create a new plan
   • BTest the recovery plan at least once every 12 months and document the results
   • CRequest an extension from the regional entity because the plan was tested 18 months ago
   • DUpdate the plan but do not test it until the next scheduled audit
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A compliance analyst is reviewing the NERC CIP standards and notices that CIP-002 has been revised multiple times. The analyst needs to reference the current version of the standard. Which approach is correct?

   • AUse the version that is most favorable to the entity to minimize compliance burden
   • BUse the most recent draft version available on the NERC website
   • CUse the version that was in effect when the entity was first registered
   • DUse the version currently in effect as approved by FERC, which is identified by a version number in the standard title
   Reveal Solution Discussion Select an answer first