Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A cybersecurity analyst at a hydroelectric facility is responsible for configuration monitoring. The facility uses a centralized SIEM to collect logs from the control network. A recent vulnerability assessment identified that many engineering workstations have unauthorized software installed. The analyst suspects that technicians are using USB drives to install tools. The SIEM does not monitor USB activity. What is the most effective way to detect and prevent this behavior?

   • AAdd USB activity logging to the SIEM by enabling Windows event logs for USB devices.
   • BDeploy endpoint detection and response (EDR) agents on all engineering workstations to monitor USB usage and software installation.
   • CConduct regular manual audits of the workstations to identify unauthorized software.
   • DDisable USB ports on all engineering workstations via Group Policy and enforce a whitelist of approved software.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst at a power generation facility notices that configuration monitoring reports a change to the firewall rule base on a critical control network segment. The change was not part of any approved change request. What should the analyst do first?

   • AVerify whether the change was an approved emergency change that was not yet documented.
   • BImmediately revert the firewall rules to the last known-good configuration.
   • CTreat the change as a potential security incident and initiate the incident response process.
   • DUpdate the configuration baseline to match the current rules to prevent future alerts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A water utility has a policy that all removable media must be encrypted and centrally managed. An employee is found using a personal USB drive to transfer water quality reports from a control system workstation to an office computer. What is the most appropriate action?

   • AScan the personal USB drive for malware and allow the employee to continue using it
   • BRetrain the employee on the removable media policy and provide a centrally managed encrypted USB drive
   • CTerminate the employee for violating the security policy
   • DDisable all USB ports on control system workstations to prevent future incidents
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A vulnerability assessment of a transportation control system is planned. The system includes both permanent assets and transient assets such as laptops used by maintenance staff. The assessment team wants to ensure all assets are covered. What is the most important consideration?

   • AInclude transient assets in the assessment scope and schedule scans when they are likely to be present
   • BFocus only on permanent assets because transient assets are not part of the system
   • CAssess transient assets separately using a different methodology
   • DAsk maintenance staff to disconnect all transient assets during the assessment
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A power utility is planning a vulnerability assessment of its substation automation system. The assessment will include active scanning of intelligent electronic devices (IEDs). The utility has a strict change management process that requires all changes to be approved. The assessment team wants to scan during normal operations to avoid overtime costs. What is the most important factor to consider before approving the scan?

   • AThe cost of the scanning tools and the assessment team's hourly rate.
   • BThe need to obtain a signed waiver from the assessment team to avoid liability.
   • CThe availability of the vendor's technical support during the scan.
   • DThe potential for active scanning to cause IEDs to fail or reboot, disrupting power operations.
   Reveal Solution Discussion Select an answer first