Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A power generation company has developed a new disaster recovery plan for its OT systems. The plan has never been tested. Management is concerned about the cost and potential disruption of a full-scale test. They want to validate the plan's feasibility and identify gaps without affecting live operations. Which testing approach best meets these requirements?

   • AConduct a tabletop exercise with key stakeholders to walk through the plan step by step.
   • BDefer testing until a real incident occurs to avoid any disruption.
   • CRun a parallel test by operating the recovery site alongside the primary site.
   • DPerform a full-scale simulation at the recovery site using actual OT systems.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of testing and exercising disaster recovery and incident response plans?

   • ATo validate the plans and improve readiness
   • BTo increase the cost of the plans
   • CTo replace the need for training
   • DTo guarantee that no incidents will occur
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which incident response team role is responsible for coordinating communication with internal and external stakeholders during an incident?

   • ALegal counsel
   • BLead analyst
   • CCommunications lead
   • DIncident commander
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a shift change at a water treatment facility, operators notice that the SCADA HMI is displaying incorrect tank levels and some valves are actuating without commands. The incident response team is activated. According to the incident response lifecycle, what should be the FIRST priority after detection?

   • AConduct a lessons-learned review to update the incident response plan.
   • BContain the affected systems to prevent further unsafe operations.
   • CEradicate the malware from all affected workstations.
   • DRestore the HMI from a known-good backup.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important for disaster recovery and incident response plans to be integrated?

   • ATo ensure that all incidents are handled by the same team
   • BTo eliminate the need for business continuity planning
   • CTo ensure a coordinated response during disruptions
   • DTo reduce the cost of security controls
   Reveal Solution Discussion Select an answer first