Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A water treatment plant uses USB drives to transfer water quality data from the laboratory to the control room. The plant has a policy that all USB drives must be scanned before use, but the policy is not consistently enforced. A recent vulnerability assessment identified that the USB drives are a potential vector for malware. What is the most effective way to enforce the policy?

   • AUse a dedicated 'USB quarantine station' that is the only point where USB drives can be used to transfer data, and require all drives to be scanned there.
   • BDisable USB ports on all computers and require data to be transferred via email.
   • CInstall antivirus software on the laboratory and control room computers and enable automatic scanning of USB drives.
   • DProvide additional training to staff on the importance of scanning USB drives.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A control system engineer needs to update the firmware on a PLC that controls a water treatment pump. The change is urgent because the vendor has confirmed a critical security vulnerability in the current firmware. The site's change management policy requires all changes to go through the formal process, but the maintenance window is only 30 minutes away. What is the most appropriate action?

   • APerform a vulnerability assessment first to confirm the risk, then decide whether to proceed without approval
   • BCancel the maintenance window and wait for the next scheduled change window to follow the normal process
   • CImplement the firmware update immediately to mitigate the vulnerability, then document the change after the maintenance window
   • DSubmit an emergency change request with the required risk assessment and obtain expedited approval before implementing
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A configuration monitoring system alerts that a file on a safety instrumented system (SIS) server has been modified. The change was not part of any approved change request. The system is still functioning normally. What is the most important immediate action?

   • AIgnore the alert because the system is functioning normally
   • BRestore the file from a known good backup immediately
   • CShut down the SIS server to prevent potential safety issues
   • DInvestigate the change to determine if it was unauthorized or malicious
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A plant operator needs to transfer a configuration file from a secure engineering workstation to a PLC in a remote location. The only available method is a USB drive. The site has a policy that removable media must be scanned before use. What is the most secure way to use the USB drive?

   • ACopy the file to the USB drive and immediately delete it after the transfer
   • BDisable the USB port on the workstation and use a network transfer instead
   • CUse any available USB drive and format it before copying the file
   • DUse a dedicated, encrypted USB drive that is scanned before and after each use and stored securely when not in use
   Reveal Solution Discussion Select an answer first