Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a primary risk associated with the use of removable media in critical infrastructure environments?

   • AIntroduction of malware from an infected device
   • BUnauthorized access to the physical facility
   • CIncreased network bandwidth consumption
   • DOverheating of the host system
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A power plant is implementing a new configuration monitoring system. The system will monitor all permanent assets, but the plant also uses transient cyber assets (e.g., contractor laptops) that are not covered. The plant manager wants to ensure that changes made by transient assets are also monitored. What is the most practical approach?

   • AExtend the configuration monitoring system to include transient assets by installing agents on them when they connect.
   • BProhibit the use of transient assets and require all changes to be made by permanent, monitored assets.
   • CRequire that all changes made by transient assets be logged manually and reviewed by the change management team.
   • DUse a network-based monitoring approach that detects changes to permanent assets regardless of the source, including transient assets.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does configuration monitoring primarily help maintain system integrity?

   • ABy replacing the need for regular backups
   • BBy automatically patching all software vulnerabilities
   • CBy detecting unauthorized changes to system configurations
   • DBy preventing all malware infections
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A defense contractor that builds components for a nuclear submarine program uses removable media to transfer design files between a classified network and an unclassified network. The transfer process is governed by a formal change management process. A new regulation requires that all removable media be encrypted and that the transfer process be auditable. What is the most important consideration when implementing this control?

   • AEnsure that the encryption keys are managed by the same team that performs the transfers to avoid delays.
   • BUpdate the change management process to include the encryption and transfer steps, and log all transfers for audit.
   • CPurchase the most expensive encryption software available to ensure compliance.
   • DTrain all personnel on the new encryption software and then immediately begin using it.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A wind farm operator allows vendor technicians to connect their laptops to the turbine control network for diagnostics. The laptops are not managed by the operator and have been used at other sites. What is the most effective way to prevent these transient assets from introducing malware?

   • APlace the vendor laptop on a separate VLAN with strict firewall rules and require a pre-connection malware scan.
   • BRequire the vendor to use a dedicated, operator-provided laptop that remains on site.
   • CDisable USB ports on the turbine control network and require all data transfers through a secure file server.
   • DAsk the vendor to sign a liability waiver before connecting their laptop.
   Reveal Solution Discussion Select an answer first