NERC CIP ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A control system engineer is being hired to work at a utility. The role requires unescorted physical access to a control center that houses Critical Cyber Assets. The engineer has a clean criminal record and has passed a basic background check. According to NERC CIP, what additional step is required before the engineer can be granted this access?

   • AThe engineer must sign a non-disclosure agreement and a code of conduct.
   • BThe engineer must undergo a personnel risk assessment that includes a review of their criminal history and other relevant factors.
   • CThe engineer must be escorted for the first 30 days of employment.
   • DThe engineer must complete a NERC CIP training course and pass a written exam.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A utility is implementing NERC CIP's systems security management requirements. The security team is configuring malware protection on a Critical Cyber Asset. The asset is a legacy system that does not support the latest antivirus software. The team is considering using a host-based intrusion detection system (HIDS) as an alternative. What is the most appropriate action?

   • ADisable malware protection on the legacy system, as it is not critical to the BES.
   • BImplement the HIDS and document the rationale for not using traditional antivirus, as the legacy system cannot support it.
   • CUse the HIDS as a replacement for antivirus, as it provides similar protection.
   • DReplace the legacy system immediately with a modern system that supports antivirus.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A utility has a recovery plan for its Critical Cyber Assets (CCAs) that includes a full restoration of all systems. During a test, the team discovers that the backup data is corrupted and cannot be restored. The compliance team wants to ensure the plan is effective. What is the most appropriate action?

   • AReplace the backup system without updating the recovery plan
   • BRevise the recovery plan to include verification of backup integrity and re-test the plan
   • CDocument the test as successful because the plan was followed
   • DDelete the test results and schedule a new test in 12 months
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A BES entity has a contractor who needs access to Critical Cyber Assets (CCAs) for a short-term project. The contractor has a valid background check from another utility. The entity wants to comply with CIP-004 without duplicating the background check. What is the most appropriate action?

   • AAsk the contractor to sign a waiver of the background check requirement
   • BGrant access without a background check because the contractor is only temporary
   • CAccept the contractor's background check if it is current and document the verification in the personnel risk assessment
   • DRequire a new background check regardless of the contractor's existing check
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A utility is revising its cyber security policies to align with NERC CIP. The current policy document is a single, comprehensive document that covers all aspects of cyber security. The compliance team is concerned that this approach makes it difficult to update specific controls without affecting the entire policy. What is the most effective way to structure the policies to meet NERC CIP requirements and improve maintainability?

   • AKeep the single comprehensive document and update it annually.
   • BCreate a single policy that references external industry standards like ISO 27001 as the sole control framework.
   • CDevelop a set of distinct, topic-specific policies (e.g., access control, patch management, incident response) that are individually maintained and reviewed.
   • DDevelop a policy that only covers the most critical assets and defers detailed procedures to a later date.
   Reveal Solution Discussion Select an answer first