Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A natural gas pipeline operator has developed a disaster recovery plan and an incident response plan. The plans have never been tested. Management wants to validate the plans without disrupting live operations. What is the MOST appropriate exercise type to conduct first?

   • AA tabletop exercise where key personnel walk through the plans step by step
   • BA full-scale simulation that includes failover to the alternate site
   • CA parallel test that runs the recovery site alongside the primary site
   • DA checklist review by the IT department only
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a cyber incident at a wastewater treatment plant, the incident commander is coordinating the response. The lead analyst has identified the malware and is working on eradication. The communications lead is preparing a statement for the public. Who is responsible for ensuring that the public statement does not reveal sensitive operational details that could aid attackers?

   • AThe lead analyst, who knows the technical details of the malware
   • BThe communications lead, who reviews all external communications for sensitive information
   • CThe incident commander, who has final authority over all communications
   • DThe plant manager, who is accountable for the facility's operations
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After a cyber incident at a natural gas pipeline, the incident response team completed eradication and recovery. The operations manager wants to ensure the same type of incident does not happen again. What is the most important action to take?

   • AIncrease the frequency of backups to reduce data loss in future incidents.
   • BConduct a post-incident review to identify lessons learned and update the incident response and disaster recovery plans.
   • CDisconnect the OT network from the internet permanently.
   • DReplace all affected hardware with new equipment.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A manufacturing company has separate disaster recovery (DR) and incident response (IR) plans. During a ransomware incident, the IR team contains the spread, but the DR team is unsure when to activate the recovery site. What is the best way to ensure coordinated response?

   • AHave the DR team wait for the IR team to fully eradicate the threat before any recovery action.
   • BActivate the DR plan immediately upon detection of any incident.
   • CIntegrate the DR and IR plans with clear triggers for activating recovery procedures.
   • DKeep the plans separate to avoid confusion between teams.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A cyber incident at a food processing plant has caused the loss of visibility into the production line's safety interlocks. The incident response team is considering whether to shut down the line. The plant manager is concerned about the cost of a shutdown, while the safety officer is concerned about the risk of an unsafe condition. The incident commander must decide. What is the MOST appropriate decision-making approach?

   • AContinue operating the line to avoid financial loss, since the incident is cyber-related
   • BWeigh the safety risk against the business impact and make a decision that prioritizes safety if the risk is imminent
   • CDelegate the decision to the plant manager, who understands the production process
   • DAlways shut down the line immediately to eliminate any safety risk
   Reveal Solution Discussion Select an answer first