Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   After a significant OT security incident, the incident response team completed the post-incident review. The review identified that the incident response plan was outdated and that the disaster recovery plan did not align with the IR plan. Management wants to ensure that these issues are addressed. What is the most effective way to implement the lessons learned?

   • AUpdate the incident response plan only, since the disaster recovery plan is separate.
   • BUpdate both plans and conduct a joint tabletop exercise to validate the changes.
   • CReplace the incident response team with new personnel to avoid past mistakes.
   • DDocument the lessons learned but do not change the plans until the next incident.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large manufacturing company is establishing an incident response team. The team will include an incident commander, lead analyst, and communications lead. The company wants to ensure that the team can effectively respond to both IT and OT incidents. What is the most important consideration when defining the roles?

   • AAssign separate incident commanders for IT and OT to avoid conflicts.
   • BEnsure that the incident commander has authority over both IT and OT response efforts.
   • CHave the communications lead report directly to the plant manager instead of the incident commander.
   • DMake the lead analyst responsible for both IT and OT technical analysis.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A pharmaceutical company's OT network is hit by a ransomware attack that encrypts the batch control servers. The incident response team is working to contain the attack, while the disaster recovery team is preparing to restore the batch control servers from backups. What is the MOST important reason for the two teams to coordinate their activities?

   • ATo communicate with regulators and customers about the incident
   • BTo ensure that recovery does not reintroduce the malware and that containment is complete before restoration
   • CTo determine which systems are most critical to restore first
   • DTo avoid duplicating efforts and reduce the number of personnel required
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a business impact analysis, what does the recovery time objective (RTO) define?

   • AThe minimum time required to test the disaster recovery plan
   • BThe maximum acceptable amount of data loss measured in time
   • CThe time needed to conduct a business impact analysis
   • DThe maximum time allowed to restore a process or system after a disruption
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst at a wastewater treatment plant sees multiple failed login attempts on the SCADA system followed by a successful login from an unknown IP address. The analyst suspects a brute-force attack. What is the most appropriate immediate action?

   • AIgnore the event because failed logins are common.
   • BReboot the SCADA server to clear any active sessions.
   • CChange the password for all users in the system.
   • DDisable the affected user account and monitor for further suspicious activity.
   Reveal Solution Discussion Select an answer first