Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A wind farm operator allows contractors to bring their own laptops to perform maintenance on turbine controllers. The laptops are not managed by the operator and are used on different wind farms. What is the most effective way to manage the risk of these transient cyber assets?

   • APerform a vulnerability scan of each laptop before allowing it to connect
   • BAllow the laptops but restrict them to a separate network segment with no access to critical systems
   • CRequire contractors to use operator-provided, hardened laptops that are scanned before and after each use
   • DAsk contractors to sign a liability waiver acknowledging the risks of using their own laptops
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A change management board is reviewing a request to update the operating system on a server that runs a legacy application critical to production. The application vendor has not certified the new OS version. The security team has identified a critical vulnerability in the current OS. What is the best decision?

   • ADefer the decision until the vendor certifies the new OS
   • BReject the change because the vendor has not certified the new OS
   • CApprove the change with a mitigation plan that includes testing the application on the new OS and a rollback plan
   • DApprove the change without testing to address the vulnerability quickly
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A pharmaceutical company's quality control lab uses a standalone system to test product samples. The system is not connected to the network, and data is transferred via USB drives. A recent audit found that the USB drives are not encrypted, and the lab's change management process does not cover data transfers. The company must comply with a new regulation requiring encryption of data at rest on removable media. What is the most efficient way to achieve compliance?

   • ADisable USB ports on the standalone system and require all data transfers to be done via a CD-R.
   • BTrain lab staff on the importance of data encryption and ask them to encrypt files manually before copying to USB drives.
   • CPurchase encrypted USB drives and update the change management process to include the use of these drives.
   • DReplace the standalone system with a networked system that uses a secure file transfer protocol.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A nuclear power plant allows engineers to use USB flash drives to transfer configuration files between the office network and the plant's control system network. A recent audit found that several drives were infected with malware. What is the most effective control to reduce this risk?

   • AReplace USB flash drives with CD-R media for all data transfers.
   • BDisable USB ports on all control system workstations and require an approved, managed file transfer mechanism.
   • CScan every USB drive with antivirus software before and after each use.
   • DEncrypt all USB drives and require a password to access them.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary role of a configuration baseline in configuration monitoring?

   • ATo serve as the reference point for detecting unauthorized changes
   • BTo provide a backup of all system data
   • CTo automatically apply security patches
   • DTo store all user passwords in an encrypted format
   Reveal Solution Discussion Select an answer first