Standards Enforcement GCIP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An entity is preparing for a CIP audit and wants to ensure that all required evidence is available. Which step should be taken first?

   • AConduct a mock audit with internal staff.
   • BIdentify all applicable CIP requirements and the evidence needed for each.
   • CSchedule the audit date with the regional entity.
   • DReview the previous audit report for findings.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A registered entity has been found non-compliant with a CIP standard due to a misconfigured firewall that was not detected by internal controls. The entity has a good compliance history and the violation did not cause a reliability impact. What is the most appropriate enforcement outcome?

   • AA directive to disconnect the affected asset from the network.
   • BA mitigation plan and enhanced monitoring requirements.
   • CA monetary penalty to deter future violations.
   • DA public disclosure of the violation.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A reliability coordinator is implementing the Reliability Assurance Initiative (RAI) and must decide how to allocate resources. The coordinator has limited staff and must choose between conducting more frequent audits or implementing a data-driven monitoring system. Which approach is more aligned with RAI's methodology?

   • AImplement a data-driven monitoring system that provides early warnings
   • BConduct more frequent audits to catch violations
   • CFocus on publicizing past violations
   • DRely on entities to self-report all issues
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A utility is implementing internal controls to ensure ongoing compliance with CIP standards. Which control is most effective for detecting unauthorized changes to critical cyber assets?

   • ADeploying file integrity monitoring on critical cyber assets.
   • BPerforming quarterly vulnerability scans of the network.
   • CImplementing a change management process that requires approval for all changes.
   • DConducting annual security awareness training for all employees.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of an internal control used to ensure ongoing compliance with CIP standards?

   • AWaiting for a violation to occur before implementing any measures
   • BRelying solely on external audits to identify issues
   • CDeleting audit logs to reduce storage costs
   • DPeriodic self-assessments and internal audits of CIP processes
   Reveal Solution Discussion Select an answer first