A compliance analyst is reviewing logs for a BES Cyber System and sees a session where a user is connected via a remote desktop protocol and is moving the mouse and clicking on the desktop. The analyst must decide whether to classify this as interactive remote access. What is the key indicator that this is interactive remote access?

The user is actively controlling the desktop in real time

The session is from an external IP address

What is the first step in the enforcement process when a registered entity is found to be non-compliant with a CIP standard?

Notice of the violation and an opportunity to respond

Revocation of the entity's registration

Public disclosure of the violation

A utility has implemented a new CIP control and wants to ensure it remains effective between audits. The compliance manager wants a mechanism that provides ongoing assurance that the control is operating as intended. Which approach best meets this need?

Wait for the next compliance audit to identify any gaps

Implement continuous monitoring with automated alerts and periodic manual reviews

Conduct an annual self-assessment using the Reliability Standards Auditor Worksheet

Rely on the vendor's documentation that the control is effective

A compliance team is reviewing remote access logs and finds that a vendor used interactive remote access to troubleshoot a critical cyber asset. The session was not logged in the required format, and the team is preparing for an audit. What is the most appropriate action?

Delete the session record to avoid detection.

Reconstruct the session details from other logs and document the gap.

Blame the vendor for not following procedures.

Ignore the missing log because the session was legitimate.

Which methodology is central to the Reliability Assurance Initiative's approach to compliance monitoring?

Requiring entities to self-certify compliance without any external review

Relying solely on entity-submitted compliance reports

Using data and risk indicators to prioritize monitoring and identify potential issues

Conducting unannounced audits of all registered entities every year

GIAC Critical Infrastructure Protection (GCIP)

Domain 1Objective 2

Standards Enforcement GCIP Practice Questions (Page 5)

Part of the Foundations and Governance domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 6–10 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 21–25

21application · medium
A compliance analyst is reviewing logs for a BES Cyber System and sees a session where a user is connected via a remote desktop protocol and is moving the mouse and clicking on the desktop. The analyst must decide whether to classify this as interactive remote access. What is the key indicator that this is interactive remote access?
Select an answer first
22foundation · easy
What is the first step in the enforcement process when a registered entity is found to be non-compliant with a CIP standard?
Select an answer first
23application · medium
A utility has implemented a new CIP control and wants to ensure it remains effective between audits. The compliance manager wants a mechanism that provides ongoing assurance that the control is operating as intended. Which approach best meets this need?
Select an answer first
24expert · hard
A compliance team is reviewing remote access logs and finds that a vendor used interactive remote access to troubleshoot a critical cyber asset. The session was not logged in the required format, and the team is preparing for an audit. What is the most appropriate action?
Select an answer first
25foundation · easy
Which methodology is central to the Reliability Assurance Initiative's approach to compliance monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.