A change request is submitted to replace a network switch in a data center. The change is approved, but during implementation the new switch fails to boot. The technician quickly swaps the old switch back in, and the network is restored. What should be documented in the change record?

Only the successful restoration of the network, omitting the failure to avoid negative records

A note that the change was completed successfully because the network is back to normal

The failure of the new switch, the rollback action taken, and the final state of the network

The serial number of the new switch and the vendor support ticket number

A regional transmission operator must replace a protective relay at a substation. The relay is a transient cyber asset because it is temporarily connected for testing before installation. The change window is short, and the operator must also update the relay's configuration to match the new settings. The change management process requires a rollback plan, but the old relay will be decommissioned immediately after the swap. What is the best approach to satisfy the change management requirement?

Use the new relay's factory default configuration as the rollback state.

Document the rollback plan as 'restore the old relay' even though it will be decommissioned, to satisfy the paperwork.

Skip the rollback plan because the change is low-risk and the window is short.

Define a rollback plan that includes re-installing the old relay if the new one fails, and keep the old relay on site until the change is verified.

A security team at a wastewater treatment plant wants to detect unauthorized changes to configuration files on its programmable logic controllers (PLCs). The PLCs are transiently connected to engineering workstations during maintenance. What is the best way to monitor configuration integrity?

Disable remote access to PLCs and require physical presence for all configuration changes.

Require that all maintenance sessions be recorded on video and review the footage for unauthorized changes.

Use a file integrity monitoring (FIM) agent on each PLC to alert on any configuration change in real time.

Store cryptographic hashes of all PLC configuration files and compare them after each maintenance session.

Why do transient cyber assets require special management in critical infrastructure environments?

Because they are permanently installed and hard to remove

Because they are always owned by external vendors

Because they may introduce malware or be unpatched

Because they are always connected to the internet

Which control measure is commonly used to mitigate the risks of removable media in critical infrastructure?

Allowing all removable media without restriction

Increasing the number of USB ports available

Disabling USB ports on critical systems

Using only wireless keyboards and mice

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 1

Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 4)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 16–20

16application · medium
A change request is submitted to replace a network switch in a data center. The change is approved, but during implementation the new switch fails to boot. The technician quickly swaps the old switch back in, and the network is restored. What should be documented in the change record?
Select an answer first
17expert · hard
A regional transmission operator must replace a protective relay at a substation. The relay is a transient cyber asset because it is temporarily connected for testing before installation. The change window is short, and the operator must also update the relay's configuration to match the new settings. The change management process requires a rollback plan, but the old relay will be decommissioned immediately after the swap. What is the best approach to satisfy the change management requirement?
Select an answer first
18application · medium
A security team at a wastewater treatment plant wants to detect unauthorized changes to configuration files on its programmable logic controllers (PLCs). The PLCs are transiently connected to engineering workstations during maintenance. What is the best way to monitor configuration integrity?
Select an answer first
19foundation · easy
Why do transient cyber assets require special management in critical infrastructure environments?
Select an answer first
20foundation · easy
Which control measure is commonly used to mitigate the risks of removable media in critical infrastructure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.