Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After completing a full-scale recovery exercise for a BES Cyber System, the recovery team lead prepares the test report. The compliance manager asks which elements are essential to include in the report to satisfy internal and regulatory expectations. Which of the following is the most essential element?

   • AA list of participants and their roles during the exercise.
   • BA summary of the exercise results, including any deficiencies and corrective actions.
   • CThe total cost of the exercise, including labor and materials.
   • DThe exact date and time the exercise was conducted.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of a Recovery Plan for BES Cyber Systems?

   • ATo identify all cyber threats that could impact BES Cyber Systems and assign risk scores
   • BTo define the security controls that protect BES Cyber Systems during normal operations
   • CTo document the steps and resources needed to restore BES Cyber Systems to a known good state after a disruption
   • DTo provide a list of vendors and their contact information for purchasing replacement equipment
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A recovery plan test for a BES Cyber System was conducted, and the test revealed that the backup tapes from the last three months were unreadable. The recovery team documented the issue and is now deciding what to do next. Which action is most appropriate?

   • ASwitch to a different backup vendor without retesting.
   • BReport the deficiency to management and initiate corrective action to replace the backup media and retest.
   • CExtend the backup retention period to 12 months.
   • DNote the issue in the test report and move on because the test is complete.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large balancing authority must validate its recovery plan for a critical EMS. The compliance team wants a high level of assurance, but the operations team cannot allow any disruption to live EMS functions. The budget allows for building a replica environment, but the replica will not have the same performance characteristics as production. Which testing approach provides the best assurance while respecting the operational constraint?

   • APerform a functional exercise on the replica environment and document any limitations.
   • BUse a simulated cyber attack on the production EMS to test recovery without a full outage.
   • CConduct a full-scale exercise on the production EMS during a planned outage.
   • DRun a tabletop exercise with the EMS team to discuss the recovery steps.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A control system owner wants to validate that its recovery plan for a SCADA system can actually restore the system from backups. The team has a spare server that can be used to test the restoration process without affecting the production system. Which testing method is most appropriate for this validation?

   • APaper test
   • BFull-scale exercise
   • CFunctional exercise
   • DTabletop exercise
   Reveal Solution Discussion Select an answer first