Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A regional water utility is updating its disaster recovery plan. The utility's SCADA system monitors and controls water pressure across the network. The BIA identified that a loss of SCADA visibility for more than 30 minutes could lead to unsafe pressure conditions, while the billing system can tolerate up to 24 hours of downtime. The budget allows for only one recovery site. Which recovery strategy should the utility implement?

   • AA warm site with SCADA servers pre-configured and data replicated every 15 minutes
   • BA cloud-based recovery site with virtual SCADA servers and hourly snapshots
   • CA hot site with real-time replication for both SCADA and billing systems
   • DA cold site with standby hardware and daily backups of SCADA and billing data
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst at a nuclear power plant is investigating a potential intrusion. The analyst has identified suspicious network traffic but is unsure whether it is a false positive. The plant's policy requires that any potential security incident be reported immediately. What is the most appropriate action?

   • AWait for more evidence before reporting to avoid a false alarm.
   • BIgnore the traffic because it is likely a false positive.
   • CDisconnect the affected system from the network immediately.
   • DReport the suspicious activity as a potential incident and begin triage to determine if it is a false positive.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A food processing plant's batch controller has been infected with malware that is altering recipe settings. The incident response team has contained the controller by isolating it from the network. What should be the NEXT step in the incident response process?

   • ARestore the controller from a backup immediately.
   • BConduct a lessons-learned review.
   • CReconnect the controller to the network to resume production.
   • DEradicate the malware from the controller and verify its integrity.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After a phishing attack compromised an administrative account at a water treatment facility, the incident response team contained the threat and restored operations. The team is now conducting a post-incident review. What is the PRIMARY purpose of this review?

   • ATo determine the exact financial cost of the incident for insurance claims
   • BTo assign blame to the employee who clicked the phishing link
   • CTo identify weaknesses in the incident response process and update the response plan
   • DTo verify that all malware has been removed from the network
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An oil refinery's safety system logs show repeated failed login attempts from an internal engineering workstation, followed by a successful login at 3:00 AM. The incident response team is activated. The team has confirmed that the workstation is compromised. What should the team do NEXT in the incident response lifecycle?

   • AConduct a lessons-learned review to update the incident response plan
   • BRecover the system by restoring from a backup
   • CContain the compromised workstation to prevent further lateral movement
   • DEradicate the threat by wiping the workstation and reinstalling the OS
   Reveal Solution Discussion Select an answer first