NERC CIP ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A utility has been audited by its regional entity and found to have a minor violation of a NERC CIP requirement. The violation was self-reported by the utility, and the utility has already implemented corrective actions. What is the most likely outcome of this process?

   • AThe utility will be placed on a probationary period and monitored for a year.
   • BThe utility will be subject to a mandatory fine, as any violation results in a penalty.
   • CThe utility will be required to shut down the affected critical cyber assets until the violation is fully resolved.
   • DThe utility will receive a notice of penalty, but the amount may be reduced due to self-reporting and corrective actions.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the minimum frequency for cyber security training for personnel with access to Critical Cyber Assets?

   • AOnly during initial onboarding
   • BAnnually
   • CEvery 3 years
   • DAt least every 15 months
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the role of the Compliance Enforcement Authority (CEA) in NERC CIP?

   • ATo develop new NERC CIP standards
   • BTo provide cybersecurity training to registered entities
   • CTo conduct annual audits of all registered entities
   • DTo monitor compliance and impose penalties for violations of NERC CIP standards
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A utility is hiring a new engineer who will have access to Critical Cyber Assets (CCAs). The hiring manager wants to ensure compliance with CIP-004. What is the most appropriate step before granting access?

   • AGrant access immediately and complete the risk assessment within 90 days
   • BRequire the engineer to sign a non-disclosure agreement and then grant access
   • CComplete a personnel risk assessment, including a background check, and provide security awareness training
   • DProvide the engineer with a temporary badge and allow access after a verbal briefing
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary criterion for identifying a Critical Cyber Asset (CCA) under NERC CIP?

   • AThe asset is connected to the internet and has a public IP address
   • BThe asset supports the reliable operation of the bulk electric system and is essential to its functionality
   • CThe asset is located in a NERC-defined high-risk geographic area
   • DThe asset is owned by a registered entity and has a value over a certain monetary threshold
   Reveal Solution Discussion Select an answer first