Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Who should receive the results of a Recovery Plan test for BES Cyber Systems?

   • AThe organization's senior management and compliance personnel
   • BOnly the external auditors
   • COnly the recovery team members who participated in the test
   • DAll employees of the organization
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which testing method is most appropriate for validating the complete recovery of a BES Cyber System, including all personnel, equipment, and procedures?

   • AFull-scale exercise
   • BFunctional exercise
   • CTabletop exercise
   • DChecklist review
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A balancing authority experienced a cyber incident that corrupted the configuration files of its RTUs. The recovery plan was used successfully to restore operations, but during the recovery, the team discovered that the backup storage location listed in the plan was no longer valid because a network change had occurred. The incident is now closed. What is the most appropriate next step regarding the recovery plan?

   • AUpdate the plan to reflect the current backup storage location and schedule a tabletop exercise to validate the change.
   • BDocument the incident in the after-action report but do not change the plan until the next annual review.
   • CConduct a full-scale recovery exercise immediately to test the entire plan from scratch.
   • DReplace the backup storage location with a cloud-based solution and update the plan accordingly.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A utility's recovery plan for its BES Cyber System was tested six months ago and passed. Since then, the utility has added a new substation with a different RTU model, and the recovery plan has been updated. The compliance manager wants to ensure the updated plan is validated, but the next annual test is not for another six months. The operations team is concerned about the cost of an additional full-scale test. What is the most appropriate action?

   • AConduct a full-scale test immediately to validate the entire plan.
   • BWait for the next annual test to validate the updated plan.
   • CPerform a tabletop exercise to discuss the new RTU procedure.
   • DConduct a functional test focused on the new RTU recovery procedure.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After conducting a functional exercise of the recovery plan for its EMS, a reliability coordinator must report the results. The compliance team asks what information should be included in the report to satisfy internal and regulatory expectations. Which set of items is most complete for the report?

   • AA summary of the exercise scenario, but no details on participant performance or deficiencies.
   • BOnly the pass/fail status of the exercise and the signature of the exercise coordinator.
   • CA list of all hardware and software versions in the environment, even if not part of the exercise.
   • DDate of the exercise, list of participants, procedures exercised, and any deficiencies identified with corrective actions.
   Reveal Solution Discussion Select an answer first