Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A hospital's facilities management system (FMS) controls HVAC and lighting. The BIA classified the FMS as 'important but not critical' with an RTO of 24 hours. The hospital's IT department wants to prioritize recovery of the electronic health record (EHR) system, which has an RTO of 2 hours. How should disaster recovery planning prioritize these systems?

   • ARecover the EHR system first because it has a shorter RTO and higher business impact.
   • BRecover the FMS first because it is part of the OT environment.
   • CRecover both systems simultaneously with equal priority.
   • DRecover the FMS first because it affects the entire facility's environment.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which incident response lifecycle phase involves actions to limit the scope and impact of an incident?

   • APreparation
   • BEradication
   • CContainment
   • DDetection
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security analyst at a nuclear power plant is reviewing SIEM alerts. An alert indicates that a control system server is communicating with an unknown external IP address on port 443. The analyst needs to determine whether this is a legitimate communication or a security incident. What is the MOST appropriate next step?

   • AIgnore the alert because port 443 is commonly used for secure communication
   • BImmediately block the external IP address at the firewall
   • CDisconnect the server from the network to prevent data exfiltration
   • DCheck the server's baseline behavior and compare the communication to known-good patterns
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A malware infection has been confirmed on a turbine control system at a power generation plant. The malware is not actively spreading but is causing intermittent control failures. The plant is currently generating power for the grid. What is the MOST appropriate recovery action?

   • AContinue operating the system while monitoring for further failures
   • BApply a security patch to the turbine control system without isolating it
   • CRestore the turbine control system from a known-good backup after isolating it from the network
   • DShut down the turbine immediately and keep it offline until the malware is removed
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is the purpose of triage in the incident detection and analysis process?

   • ATo prioritize incidents based on severity and impact
   • BTo permanently delete malicious files
   • CTo restore systems from backups
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first