Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a full-scale recovery exercise, the exercise controller is compiling the after-action report. The report will be shared with the compliance team and senior management. Which of the following is most important to include to demonstrate the exercise's value?

   • AA comparison of the exercise objectives against the actual outcomes, including any gaps.
   • BA detailed timeline of the exercise, including lunch breaks.
   • CA summary of the exercise scenario, but no mention of deficiencies.
   • DA list of all participants and their job titles, but no analysis of performance.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A recovery plan for a BES Cyber System includes detailed technical procedures but lacks a communication plan for notifying internal stakeholders and external vendors during a recovery. During a functional exercise, the recovery team successfully restored the system, but the operations center was not notified, causing confusion. What is the most appropriate improvement?

   • AAdd more technical detail to the recovery procedures.
   • BConduct a full-scale exercise to test communication under more realistic conditions.
   • CAdd a communication plan that defines who notifies whom, when, and through what channels.
   • DRemove the communication step from the plan because it is not a recovery procedure.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   After a functional recovery test, the test coordinator prepares a report. The report includes the test date, participants, and a summary of steps performed. However, it does not include the pass/fail criteria or the actual results against those criteria. The compliance auditor rejects the report. What is the most likely reason for the rejection?

   • AThe report does not include the total cost of the test.
   • BThe report does not list the vendor support contacts.
   • CThe report does not include a timeline for the next test.
   • DThe report lacks objective evidence that the recovery plan is effective.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A utility is developing a recovery plan for a newly commissioned BES Cyber System. The plan must include the steps to restore the system from backups, the personnel responsible for performing the restoration, and the hardware and software needed. Which components of the recovery plan are being addressed?

   • AIncident response, communication, and escalation
   • BTesting schedule, reporting, and triggers
   • CBackup strategy, retention, and offsite storage
   • DProcedures, roles, and resources
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A utility is planning its first recovery exercise for a newly implemented BES Cyber System. The system is critical, and the operations team is unfamiliar with the recovery procedures. The compliance team wants to validate the plan, but the budget is limited. What is the most appropriate testing strategy?

   • ASkip the tabletop and go straight to a functional exercise on production.
   • BHire an external consultant to write the recovery plan and certify it without testing.
   • CConduct a tabletop exercise first to familiarize the team, then a functional exercise on a test environment.
   • DConduct a full-scale exercise on production immediately to get the most realistic results.
   Reveal Solution Discussion Select an answer first