GIAC GCIP Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Critical Infrastructure Protection (GCIP) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCIP certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCIP Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Critical Infrastructure Protection (GCIP) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Critical Infrastructure Protection exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCIP Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCIP Sample Questions:
01. A Responsible Entity is mapping the ways its compliance is examined under the Compliance Monitoring and Enforcement Program. Its staff use the terms 'self-certification' and 'self-report' interchangeably, assuming both mean telling the Regional Entity about a problem the entity found.
How do the two mechanisms differ?
a) Self-certification, once it is filed, replaces the need for the Regional Entity's audits, spot checks, and investigations.
b) Self-certification is a periodic attestation of compliance; a self-report discloses a discovered violation.
c) A self-report is what an auditor files after a scheduled audit, not something the entity submits.
d) They are the same mechanism, since both are the entity reporting on its own compliance.
02. Two comparable Responsible Entities each have the same control lapse on a medium-impact BES Cyber System. One discovers and self-reports the lapse to its Regional Entity and starts a mitigation plan; in the other, the same lapse is first identified by the auditor.
How does the treatment of the two differ?
a) It does not differ, because the Violation Risk Factor and Violation Severity Level are fixed by the requirement and the violation regardless of who found it.
b) The difference turns only on whose internal controls were stronger, not on who reported the lapse.
c) Self-identifying and self-reporting count as mitigating factors, so that entity generally sees more favorable treatment.
d) The self-reporting entity is treated more harshly, having put a violation on the record.
03. A Responsible Entity keeps its evidence ready only for its periodic scheduled audit, assuming that is the only time its compliance is ever examined. After a reported grid event, its Regional Entity opens an examination of specific controls well before the next audit is due.
Through what means can the Regional Entity determine compliance?
a) Through a range of monitoring methods the framework provides, not the scheduled audit alone.
b) Only through the scheduled audit; any earlier examination waits for the next audit cycle.
c) Only by referring the matter to FERC, which would then conduct any such off-cycle review itself.
d) Through a Request for Interpretation submitted to clarify whether the controls in question were required at all.
04. Two Responsible Entities are comparable in size and impact rating. One has a documented, tested set of preventive and detective internal controls and can evidence that they work; the other treats internal controls as informal practice with little documentation. A manager claims the investment makes no difference to how either is audited.
How should that claim be evaluated?
a) It is correct, since internal controls matter only once a violation has been found, not during routine monitoring.
b) It is mistaken, though only because a larger number of controls always shortens an audit.
c) It is correct: every entity is audited against the same requirements, to the same depth, and on the same schedule, whatever the state of its internal controls.
d) It is mistaken: demonstrated, effective internal controls can reduce the scope or intensity of the compliance monitoring the entity faces.
05. A small utility owns only low-impact BES Cyber Systems and has filed no CIP program documents at all, reasoning that low-impact assets fall outside the standards. A reviewer questions whether the utility owes anything.
Which statement correctly describes the utility's position under the CIP standards?
a) Low-impact BES Cyber Systems are in scope and carry a defined obligation set delivered through cyber security policies.
b) The utility owes the full high- and medium-impact control set, because the standards define no reduced tier for low-impact systems.
c) Low-impact assets are exempt from the standards, so filing nothing is correct until an asset is recategorized to a higher impact level.
d) No obligations arise until the utility registers for an additional NERC function beyond the one that brought it into scope.
06. Reviewing grid operations, FERC concludes there is a reliability gap that the current CIP standards do not cover, and it wants that gap closed through the standards. An analyst asks what FERC is empowered to do about it.
What can FERC do to get the gap addressed?
a) Instruct the affected Regional Entities to write a standard for their footprints.
b) File a Standards Authorization Request with NERC to start the drafting.
c) Direct NERC to develop or modify a standard that addresses the identified gap.
d) Draft and issue the new standard itself, since it already holds the regulatory authority.
07. A newly disclosed weakness in a widely deployed class of control-system components calls for a standards change sooner than the normal development timeline allows. One team member argues that because the matter is urgent, NERC should bypass the ballot and the regulator's approval to push the change through.
What does the appropriate expedited path actually do?
a) It lets NERC impose the change without any stakeholder ballot for the duration of the declared emergency.
b) An Urgent Action Request compresses the schedule while still using balloting and regulator approval.
c) It is effectively a Request for Interpretation issued on a faster clock.
d) It waives the regulator's approval so the change can take effect immediately.
08. Industry stakeholders balloted and approved a revised CIP standard last month. An entity's compliance team, operating in the United States, asks whether it is now obligated to comply with the revised text.
What is the correct status of the entity's obligation?
a) It is obligated now, because passing the stakeholder ballot is what makes the revision mandatory.
b) It is obligated once its Regional Entity begins auditing against the revised text.
c) It is obligated as soon as NERC's Board of Trustees adopts the balloted revision.
d) It is not yet obligated; the revision becomes enforceable only once FERC approves it.
09. After a merger, an entity is now a single Responsible Entity, but its reorganization plan would divide the CIP Senior Manager duties between two vice presidents, each owning half of the CIP scope, with no single person holding overall accountability. Compliance staff flag the design before it is filed.
What must the entity restore to align with the Security Management Controls standard?
a) One CIP Senior Manager for each legacy organization, so both former companies keep the accountable owner they had before the merger.
b) A single identified CIP Senior Manager holding overall accountability for the merged entity's CIP compliance.
c) Two co-managers with equal authority, provided each documents the other as a delegate for the half of scope they do not personally own.
d) A governance committee that ratifies both vice presidents' decisions and records the outcome as shared program oversight.
10. A manager argues that once the entity has its CIP-003 cyber security policies in place, it no longer needs a separate system-security program for patching, ports and services, and malicious-code prevention, because the policies already cover security. A colleague asks what the Security Management Controls standard is actually for.
What is the primary objective of CIP-003?
a) To define the host-hardening controls of ports and services, patch management, malicious-code prevention, system logging, and account management, applied on each individual BES Cyber System.
b) To consolidate every technical CIP requirement into one master document so the entity can retire the individual standards' programs.
c) To categorize BES Cyber Systems as high, medium, or low impact so the rest of the CIP family knows what obligations apply.
d) To set the governance layer of CIP Senior Manager, cyber security policies, and low-impact obligations, which sits above the technical standards rather than replacing them.
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: c |
Question: 03 Answer: a |
Question: 04 Answer: d |
Question: 05 Answer: a |
|
Question: 06 Answer: c |
Question: 07 Answer: b |
Question: 08 Answer: d |
Question: 09 Answer: b |
Question: 10 Answer: d |
Note: For any error in GIAC Critical Infrastructure Protection (GCIP) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
