Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A utility has a recovery plan for its BES Cyber System that has been validated through tabletop exercises for the past three years. The compliance team now requires a higher level of assurance. The operations team is concerned that a full-scale test would require a prolonged outage. The budget allows for a one-time investment in a test environment. What is the most appropriate strategy to increase assurance over time?

   • AHire an external auditor to review the plan and certify it without testing.
   • BBuild a test environment and conduct a functional exercise, then gradually increase the scope of exercises over time.
   • CConduct a full-scale test on production immediately to meet the compliance requirement.
   • DContinue with tabletop exercises but add more detailed scenarios.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional transmission operator is revising its recovery plan testing strategy. The compliance team wants to validate that the recovery procedures for a critical EMS are technically accurate, but they are concerned about disrupting live operations. Which testing method best balances technical validation with minimal operational impact?

   • AA tabletop exercise with the EMS support team walking through the recovery steps.
   • BA review of the recovery plan document by an external auditor.
   • CA functional exercise on a non-production replica of the EMS environment.
   • DA full-scale exercise on the production EMS during a scheduled maintenance window.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A generation facility's recovery plan for its DCS was last tested 11 months ago. Since then, the facility has migrated from a Windows-based historian to a Linux-based historian, and the recovery plan has been updated accordingly. The compliance calendar shows the annual test is due in one month. What is the most appropriate action?

   • APostpone the annual test for three months to allow more time for the new historian to stabilize.
   • BConduct the annual functional test as scheduled, now that the plan has been updated.
   • CConduct an immediate full-scale test because the historian change is significant.
   • DPerform a tabletop exercise now and skip the annual functional test.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A generation owner conducted a tabletop exercise of its recovery plan. During the exercise, the team identified that the contact information for the backup vendor was outdated. The exercise report is being prepared. What should the report include regarding this finding?

   • AA description of the deficiency and a corrective action to update the contact information, with an assigned owner and due date.
   • BA summary of the exercise scenario, but no details on the deficiency.
   • CA recommendation to switch to a different backup vendor, since the contact information was outdated.
   • DA note that the exercise was successful, with no mention of the outdated contact information.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A recovery plan test for a BES Cyber System was conducted, and the test results showed that the recovery time objective (RTO) was exceeded by 30 minutes. The recovery team believes the delay was due to a single vendor's late response. The compliance team must report the results. What is the most appropriate way to report this?

   • ABlame the vendor in the report and take no further action.
   • BReport only the successful recovery and omit the RTO data.
   • CReport the test as passed because the system was eventually recovered.
   • DReport the RTO exceedance and include the root cause analysis and corrective actions.
   Reveal Solution Discussion Select an answer first