A distribution utility recently experienced a ransomware attack that encrypted several servers supporting its distribution management system (DMS). The recovery plan was executed successfully, but the team noted that the plan did not include a step to verify the integrity of the restored data. The compliance manager wants to ensure this gap is addressed. What is the most appropriate action?

Replace the current backup solution with one that includes built-in integrity verification.

Add the verification step to the plan but wait until the next annual test to validate it.

Conduct a tabletop exercise to discuss the incident, but do not change the plan.

Update the recovery plan to include a data integrity verification step and schedule a functional test to validate the updated procedure.

A recovery plan for a BES Cyber System was tested and passed six months ago. Since then, the system has undergone a minor patch update that does not affect the recovery procedure. The compliance calendar shows the next annual test is in six months. What is the most appropriate action?

Conduct a tabletop exercise to discuss the patch's impact.

Continue with the scheduled annual test and note the patch in the test documentation.

Conduct an immediate functional test because any change requires retesting.

Update the recovery plan to include the patch details and retest immediately.

What must be documented after a Recovery Plan test for BES Cyber Systems?

The test results, including any deficiencies and corrective actions

The list of all vendors that were contacted during the test

The cost of the test and the time spent by each participant

The names of all participants and their personal opinions

Which of the following events would typically trigger an update to the Recovery Plan for BES Cyber Systems?

A routine password change for a user account

A minor change to a non-critical application's configuration

A change in the system's operating system version

A transmission owner has a recovery plan for its substation automation system. The plan was last tested 11 months ago. Since then, the vendor released a new firmware version for the RTUs, and the owner applied it. The compliance calendar shows the next annual test is due in one month. What should the owner do?

Conduct an immediate full-scale exercise to test the firmware change, then skip the annual test.

Update the plan to reflect the new firmware, but do not test until the next annual cycle.

Delay the annual test until the next year because the firmware change is minor.

Conduct the annual test as scheduled, but include the new firmware in the test scenario.

GIAC Critical Infrastructure Protection (GCIP)

Domain 5Objective 1

Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 6)

Part of the Recovery and Information Protection domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 26–30

26application · medium
A distribution utility recently experienced a ransomware attack that encrypted several servers supporting its distribution management system (DMS). The recovery plan was executed successfully, but the team noted that the plan did not include a step to verify the integrity of the restored data. The compliance manager wants to ensure this gap is addressed. What is the most appropriate action?
Select an answer first
27expert · hard
A recovery plan for a BES Cyber System was tested and passed six months ago. Since then, the system has undergone a minor patch update that does not affect the recovery procedure. The compliance calendar shows the next annual test is in six months. What is the most appropriate action?
Select an answer first
28foundation · easy
What must be documented after a Recovery Plan test for BES Cyber Systems?
Select an answer first
29foundation · easy
Which of the following events would typically trigger an update to the Recovery Plan for BES Cyber Systems?
Select an answer first
30application · medium
A transmission owner has a recovery plan for its substation automation system. The plan was last tested 11 months ago. Since then, the vendor released a new firmware version for the RTUs, and the owner applied it. The compliance calendar shows the next annual test is due in one month. What should the owner do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 6)

Questions 26–30

A recovery plan for a BES Cyber System was tested and passed six months ago. Since then, the system has undergone a minor patch update that does not affect the recovery procedure. The compliance calendar shows the next annual test is in six months. What is the most appropriate action?

What must be documented after a Recovery Plan test for BES Cyber Systems?

Which of the following events would typically trigger an update to the Recovery Plan for BES Cyber Systems?

Keep studying — Recovery and Information Protection