Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A utility is updating its recovery plan for a BES Cyber System. The plan currently includes procedures for restoring the system from backups, but does not include a step for validating the restored data against known values. During a recent functional exercise, the team restored the system but did not verify the data, and later discovered that some data was corrupted. What is the most important lesson to incorporate into the plan?

   • AReplace the backup solution with a more reliable one to prevent data corruption.
   • BAdd a data validation step to the recovery procedures to ensure restored data is correct before returning to service.
   • CIncrease the frequency of functional exercises to catch data corruption earlier.
   • DDocument the incident in the after-action report but do not change the plan.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A regional transmission operator has just completed a major upgrade to its energy management system (EMS), replacing the historian database and adding a new vendor-provided recovery tool. The recovery plan for the EMS BES Cyber System was last tested six months ago and has not been updated since the upgrade. The compliance team asks what should be done next. Which action is most appropriate?

   • AUpdate the recovery plan to reflect the new historian and recovery tool, then conduct a tabletop exercise to validate the revised procedures.
   • BConduct a functional test of the new recovery tool using a non-production copy of the historian, without updating the plan yet.
   • CSchedule a full-scale recovery exercise immediately to validate the new tool in a production-like environment.
   • DWait until the next scheduled annual test to incorporate the upgrade, since the plan was tested only six months ago.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which testing method involves a discussion-based session where team members walk through the recovery plan without actually performing recovery actions?

   • ATabletop exercise
   • BParallel test
   • CFunctional exercise
   • DFull-scale exercise
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A recovery plan for a BES Cyber System includes a step-by-step procedure for restoring the system from backups, but it does not identify the specific personnel responsible for each step. During a recent tabletop exercise, participants were unsure who should initiate the restore. What is the most appropriate improvement to the plan?

   • ARemove the step-by-step procedure and rely on the team's experience.
   • BConduct a full-scale exercise to see who shows up.
   • CAdd a roles and responsibilities matrix that assigns each recovery step to a specific role and identifies alternates.
   • DAdd more detail to the technical steps of the restore procedure.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A utility's recovery plan for its substation automation system was tested six months ago. Since then, the utility has replaced the substation's network switches and updated the recovery plan accordingly. The compliance team is planning the next test. The utility has a limited budget and can only afford one test per year. What is the most appropriate testing approach?

   • AUpdate the plan (already done) and conduct a functional test of the recovery procedures affected by the switch replacement, and count this as the annual test.
   • BConduct a full-scale exercise immediately to validate the switch replacement, then skip the annual test.
   • CConduct a tabletop exercise to review the updated plan, and defer the functional test to the next year.
   • DWait until the next annual test to validate the switch replacement, since the plan was already updated.
   Reveal Solution Discussion Select an answer first