Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A pipeline operator has conducted a full-scale exercise that included failover to the alternate control center. The exercise revealed that the alternate center's communication systems were not compatible with the field devices. The team has updated the disaster recovery plan to address this. What is the MOST appropriate next step to ensure the fix is effective?

   • AConduct another full-scale exercise immediately to validate the entire plan
   • BConduct a targeted simulation exercise that tests only the communication system compatibility
   • CConduct a business impact analysis to reassess the RTO and RPO
   • DUpdate the plan documentation and distribute it to all stakeholders
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After a successful tabletop exercise, the incident response team identified that the disaster recovery plan did not include a procedure for restoring the PLC programming environment. The team has updated the plan. What should the team do NEXT to ensure the update is effective?

   • AFile the updated plan and move on to other tasks
   • BConduct a business impact analysis to reassess the RTO and RPO
   • CSchedule a follow-up exercise that specifically tests the updated procedure
   • DDistribute the updated plan to all team members for their records
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of a business impact analysis (BIA) in the context of disaster recovery planning?

   • ATo assign roles to incident response team members
   • BTo determine the financial cost of security controls
   • CTo identify the root cause of past incidents
   • DTo identify critical processes, dependencies, and recovery objectives
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which action is a typical outcome of a post-incident review?

   • ADeleting all logs from the incident
   • BImmediately notifying law enforcement
   • CRebuilding all affected systems
   • DUpdating the incident response plan based on findings
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A ransomware attack has encrypted the engineering workstations at a food processing plant. The plant manager wants to shut down the entire production line immediately, while the IT director wants to preserve forensic evidence. The incident response team is activated. Who should have the authority to make the final decision on whether to halt production?

   • AThe incident commander, who coordinates the response and balances operational impact with investigation needs
   • BThe communications lead, who manages external messaging and regulatory notifications
   • CThe plant manager, who owns the production line and its safety
   • DThe lead analyst, who determines the technical severity of the attack
   Reveal Solution Discussion Select an answer first