Recovery Plans for BES Cyber Systems GCIP Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A recovery plan test for a BES Cyber System was conducted, and the test was successful. However, the test coordinator did not document the specific steps that were performed, only that the test passed. The compliance auditor requests more detail. What is the most appropriate response?

   • AProvide a detailed after-action report that lists the steps performed and the results of each step.
   • BExplain that the test passed and no further detail is needed.
   • CRefer the auditor to the recovery plan document.
   • DRe-run the test and document the steps this time.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a key component of a Recovery Plan for BES Cyber Systems?

   • AA list of all employees and their personal contact information
   • BA comprehensive inventory of all hardware assets in the organization
   • CDetailed procedures for restoring system functionality, including assigned roles and required resources
   • DA summary of past security incidents and their root causes
   Reveal Solution Discussion Select an answer first
4. 33application · easy

   A utility is updating its recovery plan for a BES Cyber System. The plan currently lists the IT manager as the sole recovery lead, but the system is operated by a separate OT team. During a recent tabletop exercise, it became clear that the OT team was not aware of its recovery responsibilities. Which component of the recovery plan is most deficient?

   • ATesting schedule
   • BResource inventory
   • CBackup procedures
   • DRoles and responsibilities
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A reliability coordinator is planning the annual recovery test for a BES Cyber System. The system is critical and cannot be taken offline. The coordinator has a budget that allows for either a tabletop exercise or a functional exercise using a sandbox environment. The compliance team requires that the test validate the actual recovery procedures. Which option should the coordinator choose?

   • AFull-scale exercise, because it is the only method that truly validates recovery procedures.
   • BFunctional exercise in a sandbox, because it validates actual recovery procedures without disrupting the production system.
   • CPaper review, because it is the least disruptive and can be done quickly.
   • DTabletop exercise, because it is non-disruptive and can be conducted without taking the system offline.
   Reveal Solution Discussion Select an answer first