NERC CIP ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A compliance officer is reviewing the NERC CIP standards to understand the specific requirements for patch management. The officer notes that the requirements are detailed in a specific standard. How are these requirements organized within the NERC CIP framework?

   • AThey are included in the NERC Operating Manual, not in the CIP standards.
   • BThey are part of a single, overarching standard that covers all cyber security topics.
   • CThey are contained in a standard numbered CIP-007, which is part of a series of standards, each addressing a different aspect of cyber security.
   • DThey are defined in the Federal Energy Regulatory Commission (FERC) regulations, not in NERC standards.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which organization has the regulatory authority to enforce NERC CIP standards in the United States?

   • AThe Federal Energy Regulatory Commission (FERC)
   • BThe Department of Homeland Security (DHS)
   • CThe Environmental Protection Agency (EPA)
   • DThe North American Electric Reliability Corporation (NERC) itself
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a physical security control required by NERC CIP?

   • AVisitor logs and escort requirements for non-authorized personnel
   • BAntivirus software on all workstations
   • CFirewalls and intrusion detection systems
   • DEncryption of data at rest
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Under NERC CIP, what is required of cyber security policies?

   • AThey must be identical across all registered entities to ensure consistency
   • BThey must be approved by the federal government before implementation
   • CThey must be reviewed and updated at least annually or when significant changes occur
   • DThey must be published on a public website for transparency
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A BES entity has a Critical Cyber Asset (CCA) that runs a legacy OS. The vendor has stopped issuing patches, but the asset is essential for grid operations. The entity has implemented network segmentation and host-based firewalls as compensating controls. During an audit, the auditor asks for evidence that the compensating controls are effective. Which evidence is most appropriate?

   • AA signed attestation from the system administrator that the control is working
   • BA log of all network traffic to and from the CCA for the past year
   • CA statement from the vendor confirming that no patches are available
   • DDocumentation of the compensating control, including a risk assessment and periodic verification of its effectiveness
   Reveal Solution Discussion Select an answer first