NERC CIP ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A control room operator at a BES facility is reviewing the physical security plan for a substation that contains Critical Cyber Assets (CCAs). The plan currently includes a fence, a locked gate, and a camera system. During a review, the operator notices that the camera footage is only retained for 48 hours. The compliance lead flags this as a potential gap. What is the most likely reason this is a compliance issue?

   • ACIP-006 requires that physical access logs and monitoring records be retained for at least 90 days
   • BThe gate must be electronically controlled and monitored
   • CThe fence must be at least 8 feet high to be compliant
   • DThe camera system must be monitored in real time by a human operator
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst at a BES entity detects unusual outbound traffic from a Critical Cyber Asset (CCA) to an external IP address. The analyst suspects a possible compromise. According to CIP-008, what is the first required action?

   • ADisconnect the CCA from the network and wait for instructions
   • BClassify the event as a Cyber Security Incident and initiate the incident response plan
   • CNotify law enforcement immediately before any internal investigation
   • DDelete the logs to prevent data leakage
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A utility is performing its annual CCA identification. The team has identified a set of cyber assets that include a historian server, a firewall, and a remote access server. The historian server collects data from multiple substations. The firewall is the only gateway between the control network and the corporate network. The remote access server allows vendors to connect to the control network. The team is debating whether the firewall should be classified as a CCA. The firewall does not directly control any BES equipment, but it is the sole point of connectivity. What is the most defensible classification for the firewall?

   • ACCA, because it is part of the electronic security perimeter and is essential for the security of the CCAs behind it.
   • BCCA, but only if it is listed in the entity's CCA identification methodology.
   • CNon-CCA, because it does not directly monitor or control BES equipment.
   • DNon-CCA, because it is a network device and not a control system component.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A utility is implementing NERC CIP personnel and training requirements. The utility has a mix of employees and contractors who need access to Critical Cyber Assets. The contractors are from a third-party vendor and will have remote access to the control system for maintenance. The utility's current policy requires all personnel to undergo a personnel risk assessment, but the vendor has already performed a background check on its employees. The vendor is requesting that the utility accept their background check to avoid duplicating the process. What is the most appropriate action?

   • AAccept the vendor's background check to streamline the process and avoid delays.
   • BRequire the vendor to sign a contract that holds them liable for any security incidents.
   • CRequire the vendor's employees to undergo the utility's personnel risk assessment process before granting access.
   • DGrant the vendor's employees access on a temporary basis while the utility reviews their background checks.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A utility is developing a recovery plan for its Critical Cyber Assets. The plan includes procedures for restoring the control system after a cyber attack. The utility has a limited budget and must decide whether to invest in a full-scale recovery test or a tabletop exercise. The compliance team is concerned about meeting NERC CIP's testing requirements. What is the most appropriate approach?

   • AConduct a tabletop exercise annually, as it is less expensive and can meet NERC CIP's testing requirements if it is thorough and documented.
   • BSkip testing this year to save costs and focus on updating the plan based on lessons learned from a recent incident.
   • CConduct a full-scale test every three years and a tabletop exercise in the intervening years.
   • DConduct a full-scale recovery test annually, as it is the most rigorous and demonstrates full compliance.
   Reveal Solution Discussion Select an answer first