NERC CIP ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst at a utility detects unusual outbound traffic from a device in the control network that is identified as a Critical Cyber Asset. The traffic pattern does not match any known application. The analyst suspects a potential compromise. According to NERC CIP, what is the first required action?

   • AWait for a second occurrence to confirm the activity is not a false positive.
   • BDisconnect the device from the network immediately to contain the threat.
   • CUpdate the antivirus definitions and run a full scan on the device.
   • DReport the suspicious activity to the Electricity Information Sharing and Analysis Center (E-ISAC) and the relevant regulatory authority.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A utility is updating its cyber security policies to align with NERC CIP. The current policy for access control is outdated and does not reflect the current network architecture. The compliance team is responsible for updating the policy. What is the most important step in this process?

   • ACreating a new policy from scratch that is more comprehensive than the previous one.
   • BConsulting with external consultants to ensure the policy is best-in-class.
   • CWaiting for the next audit to identify any gaps in the current policy.
   • DReviewing the current policy and updating it to reflect the current network architecture and access requirements.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional entity conducts an audit of a BES entity and finds that the entity failed to implement a required cyber security policy under CIP-004. The entity had documented the policy but had not trained its staff on it. What is the most likely outcome?

   • ANo finding, because the policy was documented
   • BAn automatic pass, because the entity self-reported the issue
   • CA finding of non-compliance, with a potential penalty and a required corrective action plan
   • DA warning, but no penalty, because the policy was documented
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of physical security controls under NERC CIP?

   • ATo comply with local building codes and fire regulations
   • BTo ensure the physical safety of employees working in control rooms
   • CTo prevent unauthorized physical access to Critical Cyber Assets
   • DTo provide a physical backup for data storage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A system administrator is responsible for a set of Critical Cyber Assets (CCAs) that run a legacy operating system. The vendor no longer provides patches for this OS. The administrator wants to remain compliant with CIP-007. Which action is most appropriate?

   • ADisconnect the CCA from the network to eliminate the need for patching
   • BApply patches from a third-party source that claims compatibility
   • CImplement a compensating control, such as network segmentation or host-based firewall rules, and document it in the patch management plan
   • DRemove the asset from the CCA list to avoid the requirement
   Reveal Solution Discussion Select an answer first