Free CompTIA SecOT+ SOT-001 Full-Length Practice Exam: 90 Questions

This free full-length CompTIA SecOT+ SOT-001 practice exam includes 90 original IT Mastery questions across the exam domains.

Use these questions for self-assessment, scope review, and deciding what to drill next.

Count note: this page uses the full-length practice count maintained in the Mastery exam catalog. Some certification vendors publish total questions, scored questions, duration, or unscored/pretest-item rules differently; always confirm exam-day rules with the sponsor.

Exam snapshot

• Exam route: CompTIA SecOT+ SOT-001
• Practice-set question count: 90
• Time limit: 90 minutes
• Practice style: mixed-domain diagnostic run with answer explanations

Full-length exam mix

Use this as one diagnostic run. IT Mastery gives you timed mocks, topic drills, analytics, code-reading practice where relevant, and full practice.

Practice questions

Questions 1-25

Question 1

Topic: OT Threat Intelligence

An OT security team wants to standardize how it describes adversary actions seen in PLC engineering workstation logs, HMI alerts, and OT IDS events. The team needs a framework that maps observed behavior to ICS-specific tactics and techniques so it can compare campaigns and identify detection gaps. Which implementation choice best meets this need?

Options:

• A. Map findings to MITRE ATT&CK for ICS

• B. Classify events by CVSS score

• C. Build a STIX indicator feed

• D. Use the Diamond Model only

Best answer: A

Explanation: MITRE ATT&CK for ICS is the best fit when the goal is to map observed OT adversary behavior to a common set of tactics and techniques. It helps defenders describe what an adversary is doing, compare activity across incidents or campaigns, and identify monitoring or detection gaps in industrial control environments. In this scenario, the decisive requirement is behavior mapping across PLC engineering workstation logs, HMI alerts, and OT IDS events, not just sharing indicators or rating vulnerabilities.

Indicator formats, analytic models, and vulnerability scoring can support threat intelligence, but they do not provide the same ICS-specific behavior taxonomy.

• Indicator sharing with STIX can represent IOCs, but it is not the main framework for mapping ICS tactics and techniques.
• Diamond Model analysis helps relate adversary, capability, infrastructure, and victim, but it does not provide the ATT&CK technique catalog.
• CVSS scoring rates vulnerability severity, not adversary behavior observed during OT activity.

Question 2

Topic: OT Security Operations

A vendor needs to bring a calibration laptop into a Level 2 control room to update parameters on a safety-critical packaging line during a 2-hour maintenance window. The PLCs are legacy devices, production must restart on time, and the site requires traceability for all external devices entering OT areas. What is the BEST professional decision before allowing the laptop to connect?

Options:

• A. Connect the laptop only to the engineering switch during the window

• B. Scan the laptop after the maintenance work is complete

• C. Validate the laptop at the OT intake kiosk and document authorization

• D. Allow the laptop because the vendor owns the calibration software

Best answer: C

Explanation: Portable and mobile devices should be validated before they are allowed into sensitive OT environments or connected to OT assets. In this scenario, the laptop is external, the line is safety-critical, and the site requires traceability. A proper intake process should confirm authorization, record custody or tracking details, and perform posture checks such as malware scanning, approved software/media validation, device identity, and policy compliance before any OT connection. This reduces the risk of introducing malware, unauthorized software, or unmanaged connectivity while still supporting the maintenance window. Connecting first and checking later reverses the control and increases operational risk.

• Vendor ownership is not enough because trusted software does not prove the device is safe or authorized for the OT area.
• Engineering switch access still allows an unvalidated external device onto a sensitive OT path.
• Post-work scanning fails because the risk must be controlled before exposure, not after possible compromise.

Question 3

Topic: OT Cybersecurity Architecture, Design, and Engineering

A chemical plant is redesigning network access for a legacy PLC cell that controls a high-pressure process. The cell must keep running during the next 6 months, the PLCs cannot run host agents, vendors still need supervised maintenance access, and engineering wants the design to be simple enough for operators to support. Which architecture choice is the BEST professional decision?

Options:

• A. Fully isolate the PLC cell from all external systems immediately

• B. Place the PLCs on a separate flat VLAN with vendor VPN access

• C. Install endpoint security agents on each PLC and allow direct vendor access

• D. Create a cell zone with controlled conduits through an IDMZ and jump host

Best answer: D

Explanation: Simplicity and defense in depth should work together in OT architecture. For a critical legacy PLC cell, the safer design is a clear zone boundary with limited conduits, an IDMZ, supervised jump-host access, allowlisted traffic, and monitoring at choke points. This avoids direct vendor reachability to controllers while not requiring unsupported agents on PLCs or disrupting production. It is also easier for operations to understand and maintain than a complex tool-heavy design.

A simple layered design should reduce paths, centralize control points, and preserve process continuity. The key takeaway is to add layers where they create clear risk reduction, not complexity that operators cannot sustain.

• Flat VLAN access improves separation only slightly and still leaves vendor connectivity too direct for a critical PLC cell.
• PLC agents conflict with the stated legacy constraint and add operational risk without a supported change path.
• Immediate isolation may protect the cell, but it ignores required vendor maintenance and could disrupt operations during the 6-month continuity constraint.

Question 4

Topic: OT Risk Management

A water treatment plant allows vendors to reach PLC engineering software only through an IDMZ jump box with MFA and approved maintenance tickets. The risk owner needs ongoing evidence that this access control remains effective without probing controllers or interrupting operations. Which implementation choice best supports that monitoring need?

Options:

• A. Correlate jump-box, MFA, firewall, and ticket records for exceptions

• B. Ask vendors to annually attest they use MFA

• C. Track the number of unpatched PLC firmware versions

• D. Run monthly active scans from IT into the PLC network

Best answer: A

Explanation: Risk monitoring should use evidence that directly measures the control objective over time. Here, the control objective is approved, authenticated vendor access through the IDMZ jump box. Correlating jump-box session logs, MFA results, firewall records, and maintenance tickets can reveal unauthorized paths, missing approvals, failed MFA patterns, or access outside approved windows. It also avoids active probing of controllers, which could create OT availability or safety concerns. The key is continuous or periodic evidence tied to the control being monitored, not a one-time statement or an unrelated vulnerability metric.

• Active scanning may create operational risk and does not directly prove vendor access followed the approved jump-box path.
• Annual attestation is weak evidence because it relies on self-reporting rather than observed access records.
• Firmware tracking supports vulnerability management, but it does not measure whether the remote access control is effective.

Question 5

Topic: OT Incident Management

During an OT incident, an engineering workstation used for PLC programming is confirmed to contain malware. The affected production cell is stable, a spare validated engineering workstation is available, and operations confirms the infected workstation is not required for safe control. Containment has already isolated the workstation from the OT network. Which eradication action is most appropriate before recovery?

Options:

• A. Keep the workstation isolated until the next maintenance outage

• B. Rebuild the workstation from a trusted baseline image

• C. Reconnect the workstation in read-only mode for monitoring

• D. Restore PLC logic from backup to all controllers

Best answer: B

Explanation: Eradication removes the cause or compromised element after containment and before recovery. In this scenario, the infected engineering workstation is already isolated, the process can remain safe without it, and a validated spare exists. Rebuilding the compromised workstation from a trusted baseline is an appropriate eradication action because it removes malware and returns the asset to a known-good state before any reconnection. OT safety and continuity still matter, so the action is acceptable because operations confirmed the workstation is not needed for safe control. Simply waiting preserves containment but does not remove the malware. Reconnecting a known-infected host increases risk, and restoring PLC logic is not targeted to the confirmed infected component.

• Waiting only maintains isolation but does not remove the malware or compromised workstation state.
• Read-only reconnection still places a known-infected asset back into the OT environment.
• Controller restore targets PLCs even though the confirmed compromise is on the engineering workstation.

Question 6

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water utility wants enterprise analysts to receive near-real-time historian data from the control network. Operations states that no enterprise or internet-connected system may initiate sessions or send commands into the control zone. Which network security design best meets this requirement?

Options:

• A. Allow enterprise analysts to query the OT historian through a firewall rule

• B. Use a one-way gateway from the control zone to an IDMZ historian replica

• C. Place the OT historian in the enterprise network segment

• D. Provide VPN access to the historian through a jump box

Best answer: B

Explanation: The core design concept is enforcing zones and conduits with unidirectional flow. For OT data sharing, a one-way gateway or data diode between the control zone and an IDMZ can publish historian data outward while preventing inbound sessions or control commands from enterprise networks. The IDMZ provides a buffer zone for services that need to exchange data across trust boundaries without exposing controllers, HMIs, or primary historians directly.

A firewall can restrict traffic, but it still permits a routed path if rules allow queries. Remote access designs such as VPNs and jump boxes are useful for monitored maintenance, not for a no-inbound-flow requirement. The key takeaway is to match the conduit design to the required direction of trust and data movement.

• Firewall query path fails because analyst queries would still initiate sessions from enterprise toward OT.
• Remote access path fails because VPN and jump-box access is designed for managed interactive access, not one-way publishing.
• Enterprise placement fails because moving the OT historian into the enterprise segment weakens zone separation and increases exposure.

Question 7

Topic: OT Systems and Safety Foundations

A water utility is reviewing a proposed change for remote autonomous pump stations. Which interpretation best supports OT security planning?

Exhibit: Connectivity note

Control center -> regional telecom MPLS -> pump stations
Backbone owner: telecom provider, not the utility
Utility visibility: no provider switch logs or configurations
Station control: local autonomous controller maintains pressure if WAN fails
New request: station-to-station optimization traffic over the MPLS backbone
Existing control: OT firewalls at each station demarcation

Options:

• A. Disable autonomous control until the utility owns the backbone

• B. Treat the MPLS as a third-party conduit with edge controls

• C. Move station control decisions to cloud analytics

• D. Trust the MPLS because it is a private backbone

Best answer: B

Explanation: Privatized backbone infrastructure can provide dedicated connectivity, but it is still owned and operated by another party. The utility does not control provider devices or logs, so OT security planning should treat the backbone as an external conduit between zones. The important controls are at the demarcation points: explicit firewall policy, strong authentication, encryption where appropriate, monitoring at utility-owned edges, and contract terms for provider responsibilities and incident support. The autonomous pump controller also changes the risk model because it can make local process decisions when WAN connectivity is degraded. The design should preserve safe local operation while limiting and monitoring station-to-station traffic over the provider network. A private carrier service is not the same as utility-owned trusted infrastructure.

• Private equals trusted fails because a carrier MPLS service reduces exposure but does not give the utility ownership, logs, or configuration control.
• Disable autonomy overreacts because local autonomous control supports safe operation during WAN loss.
• Cloud control increases dependency on external connectivity and does not address provider backbone ownership or demarcation security.

Question 8

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water treatment plant allows an OEM to support PLC programming software on an engineering workstation. The current setup uses one shared VPN account with a known default password on the workstation, and the firewall allows remote desktop directly from the VPN to the OT workstation. Operations wants to keep vendor support available but reduce shared access and uncontrolled remote administration. Which implementation is best?

Options:

• A. Use named vendor accounts with MFA through a monitored jump box

• B. Move the workstation to a separate OT VLAN

• C. Keep the shared VPN account but rotate its password monthly

• D. Allow remote desktop only during business hours

Best answer: A

Explanation: Secure remote access in OT should preserve necessary support while removing shared or default credentials and controlling administrative paths. The best improvement is to require individual named accounts, strong authentication such as MFA, and a monitored jump box or bastion host between remote users and OT assets. This supports accountability, session control, logging, and least privilege without giving vendors direct, unmanaged access to an engineering workstation. Password rotation or time limits can reduce some exposure, but they do not solve shared identity or direct remote administration. Segmentation helps architecture, but it does not by itself fix credential accountability.

• Password rotation only leaves a shared account in place, so actions still cannot be tied to a specific person.
• Business-hour access limits when connections occur, but it does not remove default credentials or direct remote desktop exposure.
• Separate VLAN may improve network separation, but it does not provide individual authentication or controlled remote administration.

Question 9

Topic: OT Threat Intelligence

A packaging plant is updating its OT threat model. OEM technicians and corporate controls engineers are allowed to troubleshoot PLC issues from off-site by authenticating to a remote-access service and then connecting through an OT jump host. Which threat-vector entry best captures this exposure?

Options:

• A. Removable media introduced at engineering stations

• B. Third-party and internal remote access into OT

• C. On-site operator interaction with local HMIs

• D. Unauthorized field devices connected to switch ports

Best answer: B

Explanation: Remote access by third-party vendors or internal users is a distinct OT threat vector because it creates an off-site path into control environments. Even when approved for maintenance, the path can be abused through compromised accounts, weak access controls, unmanaged endpoints, excessive privileges, or poor session monitoring. In this scenario, both OEM technicians and corporate controls engineers can reach PLC troubleshooting functions through a remote-access service and jump host, so the threat model should explicitly track that vector. The key takeaway is that authorized remote access still expands the attack path into OT and must be managed as a threat vector, not treated as inherently safe.

• Removable media is a different vector involving portable storage or devices, not off-site authenticated sessions.
• Unauthorized field devices describes rogue physical or network attachment, not approved remote connectivity.
• Local HMI use is an on-site operator activity and does not capture the third-party or internal remote access path.

Question 10

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water treatment facility uses certificate-based authentication for vendor remote access through an IDMZ jump host. A vendor engineer passes MFA but cannot start an engineering workstation session to a PLC support network.

Exhibit: Access decision record

Options:

• A. Issue a replacement plant user certificate to the engineer

• B. Create a shared privileged jump-host account for the vendor

• C. Add Vendor-IT-CA as a trusted root on the jump host

• D. Enroll the laptop through the RA and issue a plant device certificate

Best answer: D

Explanation: The failed access decision is about device identity, not the engineer’s personal identity. The user certificate is valid and the registration authority has approved the contractor identity, but the endpoint certificate was issued by an external vendor CA and has no approved plant asset record. In a PKI-based OT access design, the RA performs identity proofing and authorization checks before certificate issuance. For device certificates, that means validating the endpoint as an approved asset before the plant CA issues a certificate trusted by NAC, jump hosts, or remote-access gateways.

Trusting the vendor CA would bypass the plant’s device-registration control. The safer action is to register the device through the RA and issue the required plant device certificate.

• User certificate focus fails because the exhibit shows the user certificate and user RA approval are already valid.
• Trusting the vendor CA fails because it would trust devices outside the plant RA’s asset-approval process.
• Shared privileged account fails because it weakens individual accountability and does not satisfy certificate-based device authentication.

Question 11

Topic: OT Threat Intelligence

A chemical plant receives OT threat advisories from an ISAC, OEM vendors, and a government agency. The SOC is missing which IOCs apply to legacy PLC networks, and operations will not allow automatic blocking because unplanned communication changes could affect safety and batch continuity. The plant must show a repeatable process for using intelligence in monitoring and response. Which decision is BEST?

Options:

• A. Forward all advisory emails directly to control-room operators

• B. Replace legacy PLCs before using external intelligence

• C. Automatically block every shared IOC at OT firewalls

• D. Implement a threat intelligence platform with OT tagging and approval workflows

Best answer: D

Explanation: A threat intelligence platform is useful when an organization must collect intelligence from multiple sources, normalize it, enrich it, and turn it into repeatable defensive actions. In this plant, the issue is not just receiving advisories; it is determining relevance to legacy PLC networks, tracking confidence, mapping IOCs and TTPs to OT assets, and routing changes through operations-approved workflows. A TIP can support tagging by site, asset type, protocol, vendor, confidence, and ATT&CK for ICS technique, then feed reviewed indicators or detection logic to SIEM, IDS, or case-management processes. The key is operationalization with governance, not uncontrolled enforcement in a safety-sensitive network.

• Email forwarding leaves relevance, tracking, and response ownership inconsistent, so it does not create a repeatable intelligence process.
• Automatic blocking could disrupt approved OT communications and violates the stated safety and continuity constraint.
• Asset replacement first may be part of long-term risk reduction, but it does not solve the immediate need to organize and use intelligence.

Question 12

Topic: OT Risk Management

An OT risk manager is preparing a report for the site risk committee. A critical HMI vulnerability affects a production line. A firewall rule and monitoring alert are already in place, but the vendor patch requires a 4-hour maintenance window. The committee must decide whether to approve downtime or formally accept residual risk until the next outage. What report content best fits this audience and decision?

Options:

• A. Vendor release notes, CVE text, patch hash, and installer filename

• B. Residual risk, safety impact, control status, options, and decision owner

• C. Packet captures, IDS signatures, firewall syntax, and HMI registry keys

• D. Operator shift logs, alarm counts, set points, and batch quality records

Best answer: B

Explanation: Risk reporting should match the audience and the decision being requested. A site risk committee needs concise governance-level content: current risk status, safety and production impact, what controls are already implemented, what residual risk remains, available options, and who must approve or own the decision. Technical evidence can support the report, but it should not replace the decision summary. In this scenario, the key issue is whether to schedule downtime for patching or accept residual risk temporarily, so the report should make that tradeoff clear.

• Too technical fails because packet captures and registry details are useful for analysts, not for a site risk committee decision.
• Operations-only data fails because shift logs and set points do not summarize cybersecurity risk or residual-risk disposition.
• Vendor-only detail fails because release notes and hashes support validation but do not communicate decision needs or ownership.

Question 13

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water treatment plant discovers that several vendor-installed PLC support accounts still use the vendor default password. The PLCs control chemical dosing, and the vendor confirms that password changes are supported but must be tested offline before deployment. Operations has approved a maintenance window next weekend. What is the best professional decision?

Options:

• A. Leave the defaults because the accounts are vendor-installed

• B. Block all vendor network access without changing the passwords

• C. Disable the PLC support accounts immediately during production

• D. Change the default passwords during the approved window after offline testing

Best answer: D

Explanation: Vendor-default or inherited credentials create avoidable risk because they may be known outside the organization and reused across installations. In OT, the secure action must also preserve safe operation. Since the vendor confirms password changes are supported, operations owns the maintenance window, and offline testing is required, the best decision is to test the change first and implement it during the approved window. This reduces credential risk without making an unvalidated production change to PLCs controlling a safety-relevant process. Network restrictions can be useful defense in depth, but they do not replace removing known default credentials.

• Immediate disablement may disrupt vendor support or PLC operations without testing during an active process.
• Vendor-installed defaults are not acceptable simply because they were inherited from installation.
• Network blocking only may reduce exposure but leaves the avoidable default-password weakness in place.

Question 14

Topic: OT Threat Intelligence

A chemical plant OT security team must decide whether to add temporary monitoring rules and remote-access restrictions before a weekend maintenance window. The plant has PLCs from Vendor X, an engineering workstation reachable only through a jump box, and strict uptime requirements. Which intelligence input should the team use first to support the decision?

Options:

• A. A six-month-old annual threat report describing increased nation-state interest in critical infrastructure

• B. A vendor marketing brief recommending a new monitoring platform for industrial networks

• C. A same-sector ISAC alert from today that maps Vendor X activity to observed TTPs, affected versions, IOCs, and OT-safe mitigations

• D. A generic CVE feed entry for Vendor X with no asset match, exploit context, or compensating controls

Best answer: C

Explanation: Useful OT threat intelligence should be timely, relevant, and actionable. In this scenario, the team needs to make a near-term security decision without disrupting operations, so the best input is recent intelligence tied to the same sector, the actual vendor or versions in use, observed adversary behavior, and specific mitigations or detection logic that can be reviewed for OT safety. Strategic background may inform risk discussions, but it is not enough for an immediate maintenance-window decision. A raw vulnerability mention also needs context, such as exposure, applicability, exploitability, and safe compensating controls.

• Strategic reporting may be relevant to long-term planning, but a six-month-old broad report is not timely or specific enough for immediate control changes.
• Raw CVE data can start triage, but without asset applicability or mitigation context it is not yet actionable.
• Product marketing may describe capabilities, but it is not validated threat intelligence for a specific OT decision.

Question 15

Topic: OT Security Operations

A chemical plant’s OT-aware IDS sends repeated SIEM alerts for expected historian polling of PLCs on a safety-critical reactor unit. The alert volume is causing operators to miss higher-priority notifications. The PLCs cannot be changed until the next outage, and any automated containment must be approved by OT operations because an interruption could affect process safety. Which tuning action is the BEST professional decision?

Options:

• A. Disable IDS monitoring for the reactor PLC subnet

• B. Baseline polling and keep write/safety alerts actionable

• C. Lower all PLC-related alerts to informational severity

• D. Configure SOAR to block polling sources automatically

Best answer: B

Explanation: Security-management tuning in OT should reduce false positives without hiding safety-critical activity or triggering unsafe automated responses. Expected historian polling can be baselined, deduplicated, or severity-adjusted when it is well understood and approved by operations. However, alerts for write commands, logic changes, safety-related tags, abnormal function codes, or unexpected endpoints should remain visible and actionable. SOAR actions that could isolate devices or block traffic in a live process area should require OT approval or a playbook with clear operational constraints.

The key is selective tuning: suppress known benign patterns, not entire asset classes or critical subnets.

• Subnet blind spot fails because disabling IDS coverage removes visibility for a safety-critical reactor area.
• Automated blocking fails because blocking OT traffic without operations approval could disrupt process continuity or safety.
• Broad severity reduction fails because it can bury PLC write, logic-change, or safety-related events that still need response.

Question 16

Topic: OT Threat Intelligence

A water utility receives a government alert that threat actors have used unauthorized cellular modems near remote RTU cabinets to create hidden paths into pump-station networks. Operations will not allow active scanning or controller changes during peak demand, and the intel lead needs external evidence of whether unknown radio or cellular communications are occurring near the cabinets. Which intelligence source is the best fit?

Options:

• A. Human intelligence from operator interviews

• B. Measurement and signature intelligence from thermal readings

• C. Signals intelligence from authorized RF monitoring

• D. Open-source intelligence from social media searches

Best answer: C

Explanation: The core distinction is the source of the intelligence. Signals intelligence (SIGINT) comes from communications and electronic signals, such as radio, cellular, or network-related transmissions. In this scenario, the utility needs evidence of unknown radio or cellular activity near RTU cabinets while avoiding active scans or OT changes. Passive, authorized RF monitoring supports that need without disrupting pump-station operations. Human intelligence would rely on people as sources, measurement and signature intelligence would focus on technical physical signatures such as thermal or acoustic measurements, and open-source intelligence would use publicly available information.

• Operator interviews may help with context, but they do not directly verify unknown radio or cellular transmissions.
• Thermal readings fit measurement and signature intelligence, but the stated need is communications evidence, not a physical heat signature.
• Social media searches are OSINT, but public postings are unlikely to confirm RF activity at the cabinets.
• Process-safe collection matters because the plant prohibited active scanning and controller changes during peak demand.

Question 17

Topic: OT Systems and Safety Foundations

A chemical plant wants predictive analytics for a safety-critical distillation unit. The unit uses legacy PLCs with deterministic control traffic, and operations allows changes only during a monthly maintenance window. Corporate wants fleet-level trend reporting, but the OT manager requires local control to continue if the WAN or cloud service fails. Which infrastructure approach is the BEST professional decision?

Options:

• A. Permit the vendor SaaS agent direct PLC network access

• B. Move PLC control logic to a public cloud platform

• C. Replace the OT network with a private cloud cluster immediately

• D. Run edge analytics locally and send aggregated data through an IDMZ

Best answer: D

Explanation: For safety-critical OT, cloud use should not make control dependent on WAN availability or a third-party service. Edge infrastructure can process data close to the process, preserve deterministic control behavior, and continue operating during cloud outages. A hybrid pattern can then send selected, aggregated, or mirrored historian data through an IDMZ or controlled conduit for fleet reporting. This balances safety, process continuity, legacy dependency, and enterprise analytics needs. Public cloud and vendor-provided SaaS may be useful for reporting or support, but they should not be placed directly in the real-time control path without strong architecture, ownership, and change controls.

• Public cloud control fails because it introduces WAN and provider dependency into a safety-critical control function.
• Direct vendor SaaS access fails because it bypasses controlled OT conduits and weakens operational ownership of changes.
• Immediate private cloud replacement fails because it ignores legacy constraints and the limited maintenance window.

Question 18

Topic: OT Systems and Safety Foundations

A control engineer is asked to troubleshoot intermittent PLC communications inside a motor control center while the line is still running. The area has a wet floor from a caustic washdown leak, exposed moving equipment nearby, and energized 480V equipment in the cabinet. Which action best addresses the safety requirement before work begins?

Options:

• A. Have operations slow the conveyor and keep the cabinet energized.

• B. Open the cabinet briefly while a spotter watches the area.

• C. Perform a JSA and apply LOTO before opening the cabinet.

• D. Wear chemical gloves and troubleshoot with the line running.

Best answer: C

Explanation: OT safety actions must account for injury, loss-of-life, environmental, and property hazards before cybersecurity or control troubleshooting proceeds. In this scenario, the wet caustic area, moving machinery, and energized 480V cabinet create multiple hazardous energy sources and exposure paths. A job safety analysis identifies the specific hazards, required PPE, boundaries, and work steps. Lockout/tagout then isolates and verifies hazardous energy before the cabinet is opened or work begins. Production urgency does not override personnel safety or safe work practices.

• PPE-only thinking fails because chemical gloves do not control electrical energy or moving machinery hazards.
• Reduced-speed operation still leaves hazardous energy present and does not verify safe isolation.
• Spotter reliance is insufficient because observation does not replace JSA, LOTO, and controlled access.

Question 19

Topic: OT Incident Management

During incident response at a water treatment facility, an engineering workstation may have been used to change PLC logic before an unsafe pump shutdown. The utility expects regulator and insurer review. Based on the exhibit, what is the best next action for evidence handling?

Exhibit: Incident evidence notes

Options:

• A. Start custody record; tag, seal, and secure originals

• B. Send the USB to the vendor immediately

• C. Reimage the workstation to restore normal operations

• D. Continue reviewing copied logs on the admin laptop

Best answer: A

Explanation: Chain of custody preserves evidence integrity by documenting who collected, handled, transferred, stored, and analyzed evidence. Here, the USB and workstation logs may support regulator, insurer, or forensic review, but the exhibit shows informal handling and no custody record. The next action is to stop ad hoc handling, document what has already occurred, label and seal the evidence, restrict access, and use approved storage and transfer procedures. Analysis can continue later using controlled forensic copies where appropriate. Restoring operations matters in OT, but it should not destroy or further contaminate potentially material evidence unless safety requires immediate action.

• Copied-log review fails because analysis on an uncontrolled laptop does not establish provenance or protect the original evidence.
• Immediate reimage may destroy evidence before it is preserved, unless a safety-critical need overrides normal evidence handling.
• Vendor shipment adds another transfer without documented custody, packaging, authorization, or receipt controls.

Question 20

Topic: OT Threat Intelligence

A chemical plant is comparing a recent outage to historical OT cyber-event impact patterns. Which interpretation is best supported by the exhibit?

Exhibit: Incident summary

Options:

• A. Business disruption

• B. Service dependency failure

• C. Direct manipulation of control

• D. Supply chain compromise

Best answer: B

Explanation: This scenario best matches a service dependency failure: an OT operation was affected because a supporting third-party technology service introduced a bad update. The exhibit shows affected Windows-based OT support assets, but the PLC logic and process state remained stable. It also explicitly rules out changed set points, altered logic, malicious access, and business-system outage. That separates this pattern from direct manipulation and from an indirect business disruption. A true supply chain compromise would involve adversary abuse of a trusted supplier relationship or software channel, not merely a defective vendor update.

• Direct manipulation fails because there is no evidence of changed set points, altered logic, or unauthorized control actions.
• Business disruption fails because ERP, billing, and scheduling systems remained available and were not the operational constraint.
• Supply chain compromise fails because the exhibit describes a defective update, not malicious supplier-channel abuse.

Question 21

Topic: OT Risk Management

A chemical plant wants to renew a managed-service agreement for an OEM that remotely supports analyzer workstations in the OT network. The analyzers affect product quality, but changes must be scheduled during a monthly maintenance window. Plant leadership asks, “What risk do we inherit from this provider’s access, staffing, SLAs, and support procedures before we sign the renewal?” Which assessment method is the best fit?

Options:

• A. Supply-chain risk assessment

• B. Third-party risk assessment

• C. Failure mode and criticality assessment

• D. Scenario-based risk assessment

Best answer: B

Explanation: A third-party risk assessment is the best match when the risk question is about a service provider’s access, obligations, procedures, and ability to meet OT operating constraints. In this case, the OEM is not just supplying a component; it is remotely supporting analyzer workstations under an agreement. The assessment should examine provider access controls, support staffing, SLAs, escalation paths, change coordination, and how its procedures align with plant maintenance windows and quality impact. A supply-chain assessment would focus more on product provenance, firmware, components, or vendor dependency in the procurement chain. Failure-mode analysis would focus on how equipment failures affect the process. Scenario-based assessment would model a defined threat or event, but the immediate decision is whether the provider relationship creates acceptable inherited risk.

• Supply-chain focus is too product-centered for a question about managed remote support and service obligations.
• Failure-mode focus fits equipment or process failure consequences, not provider access and contract risk.
• Scenario-based focus needs a defined threat scenario; the stem asks for provider relationship risk before renewal.

Question 22

Topic: OT Cybersecurity Architecture, Design, and Engineering

A control engineer is reviewing a proposed HMI design for a batching process. The safety requirement is to maintain operator view and control if one HMI server, network path, or power feed fails.

Exhibit: Resilience review

Which design change best addresses the resilience gap shown in the exhibit?

Options:

• A. Move HMI backups from weekly to daily

• B. Separate the HMI servers across independent power and network paths

• C. Increase the UPS runtime for the HMI rack

• D. Add a data diode between the HMI and historian

Best answer: B

Explanation: High availability depends on removing single points of failure across the service path, not just adding a standby server. In the exhibit, the HMI servers are redundant, but both rely on the same PDU, UPS, and access switch. A failure in either shared dependency can remove both HMI servers at once, violating the requirement to maintain operator view and control after one power feed or network path fails. Placing the servers on independent power and network paths better aligns redundancy with the required availability outcome.

Backups support recoverability after a failure, and UPS runtime supports endurance during power loss, but neither fixes this shared-dependency design gap.

• Longer UPS runtime helps endurance, but the stated gap is shared power and network dependency, not insufficient runtime.
• More frequent backups improve recoverability, but they do not keep operator view and control available during a component failure.
• A data diode may support secure one-way data flow, but it does not remove HMI power or switch single points of failure.

Question 23

Topic: OT Incident Management

A chemical plant is in the identify stage of an OT incident. PLC-3 controls a live dosing skid, there is no maintenance window for 8 hours, and OT operations must approve any control-network change.

Exhibit: Network evidence

Which action is the BEST professional decision?

Options:

• A. Correlate PCAP, IDS, flow, firewall, VPN, and change evidence

• B. Close the alert because the firewall allowed the session

• C. Block all TCP/502 traffic to PLC-3 immediately

• D. Reimage HMI-07 before collecting additional evidence

Best answer: A

Explanation: In OT incident identification, network evidence should be correlated before disruptive action is taken, especially when a live PLC controls a physical process and operations owns control changes. The IDS alert suggests a Modbus write, but the best next step is to validate it with packet capture details, flow timing, firewall records, VPN access, and the absence of an approved change. This supports a defensible incident scope and gives OT operations the evidence needed to decide safe containment. Immediate blocking or host rebuilds can interrupt control or destroy evidence.

• Immediate blocking may stop required control traffic and violates the stated need for OT approval before network changes.
• Early reimaging destroys volatile and forensic evidence before the suspected control action is validated and scoped.
• Firewall allowed only shows policy permitted the session; it does not prove the Modbus write was authorized.

Question 24

Topic: OT Cybersecurity Architecture, Design, and Engineering

An OT site walkdown found repeated tailgating into the PLC cabinet room. Operations wants stronger controlled entry without interfering with code-required emergency egress.

Exhibit: Physical access finding

Which control best addresses the finding?

Options:

• A. Install an access control vestibule with interlocked doors

• B. Increase door-forced-open alarm sensitivity

• C. Add another camera covering the PLC room door

• D. Replace badge access with a shared keypad PIN

Best answer: A

Explanation: An access control vestibule, often called a mantrap, uses two controlled doors so only one door opens at a time and entry can be authenticated before the person reaches the protected area. In this scenario, the problem is not lack of recording or forced-entry detection; it is that a single badge event allows multiple people to enter. A vestibule directly supports controlled entry and tailgating reduction for an OT room, while the design must still maintain required emergency egress and safety requirements. Detection-only controls may help investigations, but they do not prevent piggybacking at the doorway.

• More cameras improve evidence collection but do not stop multiple people entering on one badge event.
• Shared keypad PIN weakens accountability and can still be shared or used by groups.
• Alarm sensitivity addresses forced-door conditions, not authorized-door tailgating.

Question 25

Topic: OT Security Operations

A plant security team wants to hunt for unauthorized changes to PLC logic during production hours. The controls team prohibits active scanning on the cell/area network. The hunt must identify the engineering workstation, target controller, and OT protocol operation involved. Which implementation choice best supports this hunt?

Options:

• A. Export monthly software inventory from engineering workstations

• B. Collect passive OT protocol metadata from a switch SPAN

• C. Review historian process-variable trends for abnormal values

• D. Run authenticated vulnerability scans against each PLC

Best answer: B

Explanation: Threat hunting in OT often relies on passive artifacts that do not disturb deterministic control traffic or fragile devices. For a suspected unauthorized logic change, network-derived OT protocol metadata or packet captures can identify who communicated with which controller and what type of operation occurred, such as a write, download, upload, or programming-related function. A SPAN/TAP feed to an OT-aware IDS or sensor is appropriate because it supports visibility without active polling or scanning.

Historian data may show process impact, but it usually does not prove which workstation issued a controller operation. The key takeaway is to match the artifact to the hunting question while respecting OT safety and availability constraints.

• Historian-only hunting may reveal abnormal process values, but it lacks the source workstation and protocol operation needed here.
• Active PLC scanning conflicts with the production constraint and can introduce availability risk on OT networks.
• Software inventory helps asset management, but it does not show controller communication or logic-change activity.

Questions 26-50

Question 26

Topic: OT Risk Management

A chemical plant is updating its OT risk register before a 6-hour maintenance window. The control engineer provides narrative evidence: an unsupported PLC controls a feed pump, a failed change could cause an off-spec batch, and operations can run manually for only 20 minutes. There is no validated incident frequency, downtime cost, or probability model. Management asks for the BEST assessment approach that supports a defensible decision without overstating confidence. What should the OT security engineer do?

Options:

• A. Delay all risk scoring until precise failure data exists

• B. Calculate annualized loss expectancy from estimated costs

• C. Use a qualitative assessment with documented assumptions

• D. Rank the risk only by the PLC vulnerability score

Best answer: C

Explanation: Qualitative assessment is appropriate when the available evidence is descriptive, judgment-based, or incomplete. In this scenario, the engineer has credible OT context from operations, including safety and process-continuity consequences, but lacks validated numeric inputs such as frequency, probability, and loss values. A qualitative method can rank likelihood and impact using defined categories, SME input, criticality, and documented assumptions. Quantitative methods are stronger when reliable numeric evidence exists and the model is defensible. The key is not to invent precision: use the best available evidence now, document uncertainty, and update the risk entry when better numeric data becomes available.

• Estimated ALE fails because annualized loss expectancy requires defensible numeric inputs, not unsupported guesses.
• Vulnerability-only ranking misses process impact, asset criticality, and manual-operation limits.
• Waiting for perfect data leaves a maintenance-window decision unsupported when qualitative evidence is already useful.

Question 27

Topic: OT Risk Management

A chemical plant is finalizing a master service agreement with an OT integrator for HMI and engineering-workstation support. The SOW already defines the initial upgrade deliverables, and an MOU already defines coordination with the corporate SOC. The plant still needs measurable ongoing commitments for critical-ticket acknowledgement, emergency onsite response, and monthly patch-status reporting. Which MSA component is the best place for these commitments?

Options:

• A. Procurement security requirements

• B. Memorandum of understanding

• C. Service-level agreement

• D. Statement of work

Best answer: C

Explanation: A service-level agreement is the best fit when an MSA needs measurable, ongoing service commitments. In this scenario, the deliverables for the upgrade are already covered by the SOW, and SOC coordination expectations are already covered by the MOU. The remaining items are operational service expectations: acknowledgement time, onsite response, and recurring patch-status reporting. These should be written so they can be measured, reviewed, and escalated if the vendor misses them. The key distinction is that an SLA governs service performance after the agreement is active, while a SOW defines work scope and deliverables for a specific engagement.

• SOW scope trap fails because the initial upgrade deliverables are already defined, and the remaining need is ongoing service performance.
• MOU coordination trap fails because SOC cooperation is already addressed, and an MOU is not the primary place for measurable service targets.
• Procurement timing trap fails because procurement requirements specify what must be purchased or qualified, not ongoing support metrics after award.

Question 28

Topic: OT Systems and Safety Foundations

A chemical plant wants to add predictive maintenance analytics for pump vibration and temperature data. PLC control loops and operator alarms must remain available during WAN outages, and no cloud service may directly issue control commands. The business also wants aggregated maintenance dashboards available to corporate reliability engineers. Which infrastructure choice best fits these OT requirements?

Options:

• A. Use edge processing with filtered cloud analytics

• B. Move HMI and alarm functions to a public cloud service

• C. Route PLC command traffic through a vendor cloud portal

• D. Keep all data in an isolated private cloud only

Best answer: A

Explanation: The core concept is matching cloud placement to OT safety, latency, and availability needs. For this plant, control loops and alarms must keep working even if the WAN or cloud is unavailable, so those functions should remain local to the OT environment. Edge infrastructure can process or buffer equipment data close to the process, while a controlled hybrid pattern can forward filtered, non-control data to a public or enterprise cloud for dashboards and analytics. Vendor-provided cloud services may be useful for diagnostics, but they should not become the direct control path unless the architecture and risk controls explicitly support that need. The key takeaway is to separate operational control from cloud-dependent analytics.

• Cloud-hosted HMI fails because alarm and operator functions would depend on WAN/cloud availability.
• Vendor command path fails because the requirement prohibits cloud services from directly issuing control commands.
• Private cloud only can improve control, but it does not satisfy the corporate cloud analytics and aggregation need as well as an edge-hybrid approach.

Question 29

Topic: OT Security Operations

A plant firewall between the cell/area zone and the operations zone was changed to default deny. The site historian must continue polling three PLCs for process values over Modbus/TCP. Engineering downloads and other write activities must not be permitted through this conduit. Which firewall tuning choice best supports the required OT data flow?

Options:

• A. Disable the conduit firewall during historian polling windows

• B. Allow historian-to-PLC Modbus/TCP for the three PLCs only

• C. Allow all operations-zone hosts to the PLC subnet

• D. Permit PLC-initiated sessions to the historian on all ports

Best answer: B

Explanation: Firewall tuning in OT should preserve the required process data flow with the smallest practical rule scope. Here, the known flow is historian polling to three PLCs using Modbus/TCP, so the rule should be limited by source, destination, and service. The default-deny posture remains in place for engineering downloads, broad subnet access, and unexpected ports. If the firewall supports OT protocol inspection, read-only function restrictions and logging can further strengthen the rule, but the core tuning decision is still a specific allowlist for the required conduit traffic.

The key takeaway is to enable the documented OT flow without converting the conduit into general network access.

• Broad subnet access allows more hosts than the requirement identifies, increasing exposure to the PLC network.
• Wrong session direction permits traffic that does not match the historian polling requirement and opens unnecessary ports.
• Firewall bypass undermines policy enforcement instead of tuning the policy to support the needed flow.

Question 30

Topic: OT Systems and Safety Foundations

A plant asset review finds a boiler control skid with an unsupported HMI operating system, a legacy engineering application, and an RS-232 service port used for PLC maintenance. The skid cannot be replaced until the next outage, and control logic must not be changed. Which implementation choice best reduces the risk from these legacy components?

Options:

• A. Run aggressive active scans during production

• B. Keep remote vendor access continuously enabled

• C. Move the HMI application directly to a cloud VM

• D. Apply compensating isolation and physical-port controls

Best answer: D

Explanation: Legacy and unsupported OT assets are risk sources because they often cannot be patched, may require outdated applications, and may expose older physical or protocol interfaces. When replacement is not immediately possible, the safer OT choice is usually compensating control: reduce reachable paths, restrict communications, control physical access to service ports, monitor allowed conduits, and plan replacement during an approved outage. This addresses the risk without changing control logic or disrupting production.

Cloud migration, aggressive active scanning, or persistent remote access can increase exposure or create operational risk if applied without engineering validation and change approval.

• Cloud migration can introduce new connectivity and compatibility risks instead of reducing exposure to the skid.
• Active scanning may disrupt fragile legacy OT devices, especially during production.
• Persistent remote access increases the attack surface around an already unsupported environment.

Question 31

Topic: OT Threat Intelligence

An OT cybersecurity engineer is reviewing a historical event report about a ransomware incident that disrupted fuel distribution through business-system outages and precautionary operational shutdowns. The plant has no matching alerts, no confirmed compromise, and only wants to understand whether similar IT dependencies could interrupt production scheduling and shipping. Which process action best uses this historical event?

Options:

• A. Add an IT-to-OT dependency scenario to the risk register

• B. Block all remote access until attribution is complete

• C. Treat current scheduling delays as ransomware indicators

• D. Declare an OT incident attributed to the same actor

Best answer: A

Explanation: Historical OT and OT-adjacent events can improve risk posture even when they do not support immediate incident attribution. In this scenario, there are no matching alerts, no confirmed compromise, and no current evidence tying the plant to the historical actor or campaign. The useful lesson is the indirect operational impact: business-system disruption can affect OT production, logistics, or shutdown decisions. The appropriate action is to document the scenario, evaluate dependencies, and consider controls such as segmentation, continuity planning, tabletop exercises, or recovery requirements. Attribution requires current evidence such as matching TTPs, IOCs, access logs, malware, or forensic findings.

• Premature attribution fails because the stem provides no current evidence connecting the plant to the historical actor.
• Broad access blocking is not justified as an immediate containment action without an active incident state.
• Assuming ransomware confuses an operational symptom with evidence of compromise or attribution.

Question 32

Topic: OT Threat Intelligence

A water utility receives an ISAC threat-intelligence note. The OT security team must decide whether it applies to local assets before opening an emergency change request.

Exhibit: Threat note and asset snapshot

Threat note applicability:
- Vendor/model: AquaRTU AR-500
- Firmware: earlier than 3.8
- Protocol: Modbus/TCP enabled
- Operating condition: vendor remote session active during production

Local assets:
RTU-14 | AquaRTU AR-500 | FW 3.6 | Modbus/TCP | vendor session Sundays | lift pumps
RTU-21 | AquaRTU AR-500 | FW 3.9 | Modbus/TCP | vendor session Sundays | chlorine dosing
PLC-08 | DeltaPLC D200  | FW 2.4 | Modbus/TCP | no remote session     | filters
RTU-32 | AquaRTU AR-500 | FW 3.6 | DNP3 serial | vendor session Sundays | tank level

Which interpretation is best supported by the exhibit?

Options:

• A. The intelligence applies most directly to RTU-14.

• B. The intelligence applies most directly to PLC-08.

• C. The intelligence applies most directly to RTU-21.

• D. The intelligence applies most directly to RTU-32.

Best answer: A

Explanation: Threat intelligence is actionable in OT only after it is validated against the local environment. The exhibit gives four required applicability conditions: vendor/model, firmware version, protocol, and operating condition. RTU-14 is the only asset that matches all four: AquaRTU AR-500, firmware earlier than 3.8, Modbus/TCP enabled, and a vendor remote session during production. The controlled process function matters for impact analysis, but it does not override the listed applicability criteria. Assets that match only the vendor or only the protocol should be tracked, but they should not drive an emergency change request based on this note alone.

• Patched firmware fails because RTU-21 runs firmware 3.9, which is outside the stated vulnerable range.
• Wrong vendor fails because PLC-08 uses Modbus/TCP but is not the affected vendor/model.
• Wrong protocol fails because RTU-32 matches the vendor and firmware but uses DNP3 serial, not Modbus/TCP.

Question 33

Topic: OT Security Operations

A water treatment facility’s SIEM is flooded after a new historian collector is connected to the control network. Operators require immediate escalation for unauthorized writes or controller mode changes. Which tuning action best reduces noise while preserving safety-critical visibility and response discipline?

Exhibit: SIEM/IDS summary

Options:

• A. Baseline the historian reads and retain critical write/mode-change alerts

• B. Escalate every PLC-related alert as a critical incident

• C. Auto-block the historian whenever the alert rate exceeds baseline

• D. Disable OT IDS inspection between the historian and PLC subnet

Best answer: A

Explanation: Security-management tuning in OT should reduce alert fatigue without removing visibility into actions that can change the process. The exhibit shows a known, approved historian generating high-volume read-only polling with no process impact. That pattern is a good candidate for baselining or allow-list suppression. However, rules for writes, controller mode changes, and SIS-related traffic must remain visible and tied to disciplined escalation because those events can affect safety, control, or availability. Good tuning is narrow, evidence-based, and reversible; it does not broadly silence an OT segment or trigger disruptive automated containment for expected polling traffic.

• Disabling inspection across the historian-to-PLC path would also hide unauthorized writes or unexpected protocol behavior.
• Auto-blocking the historian based only on alert volume could remove operational visibility and create a process-support issue.
• Escalating every PLC-related event preserves visibility but worsens alert fatigue and undermines response discipline.

Question 34

Topic: OT Security Operations

A water treatment plant receives a vendor bulletin for a critical HMI vulnerability. The affected HMI runs on a legacy OS, interfaces with a PLC using an older driver, and supports a process that can only be stopped during a 4-hour monthly maintenance window. The vendor patch is available, but the bulletin lists a minimum driver version that the plant has not validated. What is the best professional decision before choosing remediation?

Options:

• A. Block all HMI-to-PLC traffic until the patch is tested

• B. Defer remediation until the legacy OS is replaced

• C. Validate applicability, dependencies, and rollback in a test environment

• D. Install the patch immediately on the production HMI

Best answer: C

Explanation: OT vulnerability remediation should consider more than patch availability. The team must confirm the patch applies to the installed asset, verify that required dependencies such as drivers or firmware are supported, assess whether the change is viable within the maintenance window, and prepare validation and rollback steps. In this scenario, the patch exists, but an unvalidated driver dependency could disrupt HMI-to-PLC communication and affect process continuity. Testing in a representative environment with stakeholder approval is the safest path before selecting implementation, compensating controls, or deferral.

• Immediate patching ignores dependency uncertainty and could cause loss of view or control during operations.
• Open-ended deferral may leave a critical vulnerability exposed without first assessing viable remediation or compensating controls.
• Traffic blocking would likely interrupt normal HMI-to-PLC communication and harm operations rather than safely reducing risk.

Question 35

Topic: OT Security Operations

An OT security engineer is triaging vulnerability alerts before the monthly maintenance window. Patch time is limited, so the engineer must first identify the finding that is both applicable to the actual environment and highest priority. Which finding should be prioritized?

Exhibit: Vulnerability triage notes

Options:

• A. F-104, the historian remote desktop vulnerability

• B. F-102, the HMI print service vulnerability

• C. F-101, the PLC web configuration vulnerability

• D. F-103, the controller OpenSSL library vulnerability

Best answer: C

Explanation: OT vulnerability triage should confirm applicability before ranking urgency. Applicability depends on the actual asset model, firmware or software version, enabled feature, installed component, exposure, and operational consequence. F-101 matches the vulnerable model and firmware, the required web configuration feature is enabled, and the PLC controls a safety-relevant process function, so it should be prioritized for remediation planning or compensating controls. The other findings fail a required condition: a disabled service, an absent component, or a fixed application version. High severity from a scanner or advisory is not enough when the affected condition is not present in the OT environment.

The key takeaway is to prioritize verified, exposed, process-relevant risk over unvalidated scanner matches.

• Disabled service makes the HMI print finding not currently applicable under the advisory condition.
• Absent component means the OpenSSL finding does not apply to the controller shown in the SBOM.
• Stale CPE match does not outweigh the verified historian version that is already beyond the affected range.

Question 36

Topic: OT Systems and Safety Foundations

A water utility is adding cyber monitoring to a remote pump station. The station uses a legacy RTU on a multidrop RS-485 segment with Modbus RTU. Operators report that short polling delays can cause nuisance alarms, and the next approved outage window is three months away. Which communication consideration is the best professional decision?

Options:

• A. Run active Modbus discovery scans during normal pump operation

• B. Add a general-purpose Wi-Fi bridge to bypass the serial cabling

• C. Replace the serial segment with Modbus TCP before the outage window

• D. Use passive, serial-aware monitoring that preserves bus timing and termination

Best answer: D

Explanation: Legacy serial OT communications often depend on electrical characteristics and timing, not just the application protocol. RS-485 multidrop Modbus RTU uses shared media, termination, device addressing, and polling behavior that can be disrupted by added traffic or physical changes. With nuisance alarms tied to polling delays and no approved outage window, the safest communication consideration is to observe without changing production behavior. Passive, protocol-aware monitoring at an appropriate tap, gateway, or collection point can improve visibility while preserving process continuity.

Active scanning, protocol conversion, or ad hoc wireless bridging may be useful in some projects, but they require engineering review, testing, and change approval before touching a sensitive production segment.

• Active polling risk fails because added Modbus requests can disrupt timing on a production serial bus.
• Protocol conversion risk fails because replacing serial with Ethernet changes the communication path before an approved outage.
• Wireless shortcut risk fails because a general-purpose bridge adds reliability and security concerns without addressing legacy serial constraints.

Question 37

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water-treatment plant uses a legacy PLC in a locked panel that controls chemical dosing. The PLC has a USB programming port and an unused Ethernet service enabled by default. Operators need uninterrupted control until the approved maintenance window next week, and the vendor must load a signed firmware update from removable media because the PLC is not network-managed. Which security choice is the BEST professional decision?

Options:

• A. Allow the vendor to use any laptop and USB drive

• B. Use approved scanned media, then disable unused services during the window

• C. Physically block all PLC ports immediately

• D. Enable remote management so firmware can be pushed over Ethernet

Best answer: B

Explanation: Secure OT hardware management should reduce exposure without disrupting safe operations. In this scenario, the PLC is critical to chemical dosing, so immediate port blocking or unplanned network changes could affect supportability or control. The best approach is to use authorized removable media that has been scanned at a controlled kiosk or equivalent process, verify the signed update, perform the work in the approved maintenance window, and then disable unused services such as the default Ethernet service. This addresses removable-media risk, port protocol management, service reduction, and change discipline. The key takeaway is to apply hardware controls in a way that is coordinated with operations and safety requirements.

• Immediate blocking may prevent required vendor maintenance and bypass the approved change window for a critical controller.
• Uncontrolled media ignores a common OT malware path and does not enforce authorization or scanning.
• New remote management increases exposure and changes the architecture without a stated operational requirement or approval.

Question 38

Topic: OT Systems and Safety Foundations

An OT cybersecurity engineer is updating the asset inventory for a manufacturing site before redesigning zones and conduits. A server receives production orders from ERP, sends work instructions and recipe parameters to line HMIs, and records throughput and quality data. It does not directly perform interlocks, emergency shutdown, or closed-loop control. The classification must preserve safety-system separation and avoid unnecessary downtime. Which classification is the best professional decision?

Options:

• A. MES

• B. SCADA

• C. Localized control network

• D. SIS

Best answer: A

Explanation: A manufacturing execution system (MES) manages production execution functions such as work orders, recipes, quality records, traceability, and throughput reporting. In this scenario, the server bridges ERP-level planning and shop-floor execution by sending instructions to HMIs and collecting production data. It is not the system providing emergency shutdown, protective interlocks, or deterministic closed-loop control. Correctly classifying it as MES supports proper zoning and access decisions while keeping the safety instrumented system and control networks separated from business workflow functions. The key distinction is operational role: MES coordinates production execution; it does not supervise wide-area field assets like SCADA or enforce safety functions like SIS.

• SCADA supervision is plausible for monitoring, but SCADA primarily supervises distributed assets and field control, not production-order execution.
• SIS protection fails because the server does not perform independent safety interlocks or emergency shutdown.
• Localized control network is too low-level because the described function is production execution coordination, not a small local controller network.

Question 39

Topic: OT Security Operations

A packaging plant completed an approved remediation for a vulnerability on an engineering workstation. The OT security engineer must select verification evidence that confirms the remediation reduced the documented risk.

Exhibit: Vulnerability record

Options:

• A. Corporate laptop scan showing no SMBv1

• B. Vendor advisory describing the SMBv1 risk

• C. Authenticated host check plus IDMZ SMB block test

• D. Closed change ticket with maintenance approval

Best answer: C

Explanation: Remediation verification should prove that the specific documented risk has been reduced, not merely that work was planned or generally understood. The exhibit defines two technical acceptance criteria: SMBv1 must be disabled on EWS-2, and SMB sessions from the IDMZ must not reach that workstation. Evidence should also avoid disrupting operations, so confirming HMI functions remain unaffected supports OT safety and continuity. The strongest verification ties directly to the affected asset, the vulnerable service, and the network exposure path.

• Closed ticket evidence shows process completion, but it does not prove the vulnerable condition changed.
• Vendor advisory evidence explains the risk, but it is not post-remediation verification for EWS-2.
• Corporate laptop scan checks the wrong asset group and does not validate the OT workstation or IDMZ conduit.

Question 40

Topic: OT Risk Management

A chemical facility already maps enterprise risk reporting to NIST CSF. The OT team now needs a control context for segmenting PLC, HMI, and historian networks into zones and conduits and defining OT security requirements for those industrial systems. Which context is the best fit?

Options:

• A. NS2

• B. NERC CIP

• C. CRA

• D. ISA/IEC 62443

Best answer: D

Explanation: ISA/IEC 62443 is the best fit when the requirement is specifically about OT control architecture, zones and conduits, and security requirements for industrial automation and control systems. NIST can provide broad cybersecurity risk management structure, but the stem asks for an OT-specific implementation context for PLCs, HMIs, and historians. NERC CIP is primarily tied to electric-sector reliability requirements, while NS2 and CRA are broader regulatory contexts rather than detailed OT segmentation and control engineering guidance. The key is matching the framework or regulation to the operational control objective, not choosing the most familiar name.

• Electric-sector scope fails because NERC CIP is focused on bulk electric system reliability, not general chemical facility OT segmentation.
• Regulatory directive fails because NS2 is a compliance context, not the detailed zones-and-conduits control model requested.
• Product regulation fails because CRA is more aligned to cyber resilience requirements for products, not facility OT network design.

Question 41

Topic: OT Incident Management

During an OT incident, operators report that an HMI trend for a reactor temperature stayed flat at 72°C while a local gauge and an independent safety alarm indicated a rapid increase. The incident commander needs evidence that best confirms whether this was manipulation of view rather than a normal process condition. Which evidence source should be prioritized?

Options:

• A. Firewall allow-rule documentation

• B. Controller tag history and sequence-of-events records

• C. HMI workstation antivirus scan results

• D. Maintenance training attendance records

Best answer: B

Explanation: Manipulation of view means the operator’s displayed information may not match the real process state. The strongest confirmation comes from evidence closest to the control process, such as PLC/controller tag history, RTU data, historian values sourced from controllers, and sequence-of-events records. These sources can be compared with the HMI trend to determine whether the HMI was frozen, delayed, or altered while the field process actually changed. Host security data and firewall rules may help with scoping or root cause later, but they do not directly prove the mismatch between displayed values and process reality. Prioritize process-aware evidence that preserves timing and actual control-system state.

• Antivirus results may identify malware on the HMI, but they do not directly prove the displayed temperature differed from the controller value.
• Firewall documentation can explain allowed paths, but it does not validate the process state or operator display accuracy.
• Training records may support readiness review, but they are not technical evidence of view manipulation.

Question 42

Topic: OT Threat Intelligence

An OT security team receives intelligence from an ISAC, OEM advisories, and a government bulletin. Analysts are spending most of the shift copying indicators into spreadsheets and manually deciding which detections apply to plant assets.

Exhibit: Intelligence intake note

Sources: ISAC email, OEM portal, government STIX feed
Content: IPs, domains, file hashes, ICS TTP notes
Problem: Duplicate entries and inconsistent formats
Need: Map relevant TTPs to OT assets, track analyst actions,
      and publish approved indicators to SIEM and OT IDS
Constraint: No direct blocking changes without OT approval

Which capability best addresses the operational need shown in the exhibit?

Options:

• A. Automatic firewall block list

• B. Stand-alone vulnerability scanner

• C. Threat intelligence platform

• D. Manual IOC spreadsheet

Best answer: C

Explanation: A threat intelligence platform (TIP) helps organize and operationalize intelligence when the team has multiple sources, inconsistent formats, duplicate indicators, and a need to connect intelligence to OT defensive actions. In this scenario, the issue is not just finding vulnerabilities or blocking traffic. The team must normalize feeds, deduplicate IOCs, enrich them with context, map TTPs to relevant OT assets, track analyst decisions, and publish approved indicators to monitoring tools such as a SIEM or OT IDS. The OT approval constraint also matters: operationalizing intelligence should support controlled workflows, not unmanaged automatic blocking. The key takeaway is that a TIP turns raw intelligence feeds into governed, usable defensive tasks for OT security operations.

• Vulnerability scanning finds weaknesses on assets, but it does not manage multi-source intelligence intake or IOC/TTP workflows.
• Manual spreadsheets may track small IOC lists, but they do not scale well for normalization, deduplication, enrichment, or tool integration.
• Automatic blocking ignores the OT approval constraint and could create unsafe or disruptive process impacts.

Question 43

Topic: OT Risk Management

A water treatment utility is defining the boundary for an OT risk assessment of its chlorine dosing process. The process is safety-critical, includes a legacy PLC network that cannot tolerate active scanning, uses a historian in an IDMZ for reporting, and has vendor remote access through a jump box approved by operations. Which scoping decision is the BEST professional choice?

Options:

• A. Use active discovery first to confirm every OT device

• B. Exclude vendor access because it is already operations-approved

• C. Limit scope to PLCs, HMIs, and field I/O panels

• D. Include process assets, supporting conduits, IDMZ historian, and remote-access path

Best answer: D

Explanation: Scoping an OT risk assessment means defining the assets, networks, conduits, dependencies, and external access paths that could affect the process being assessed. For a safety-critical chlorine dosing process, the boundary should not stop at controllers and operator screens. It should include supporting systems such as the IDMZ historian if it receives or influences operational data, and the approved vendor jump-box path because it is part of the threat surface. The legacy PLC constraint also matters: discovery should rely on passive collection, documentation review, and operations-led walkdowns rather than disruptive scanning. The key takeaway is to scope by process impact and credible exposure, not only by device type or ownership approval.

• Device-only scope misses supporting systems and conduits that may affect visibility, reporting, or access to the process.
• Active discovery first conflicts with the stated legacy PLC constraint and could create operational risk.
• Approved vendor access still belongs in scope because approval does not remove exposure or dependency.

Question 44

Topic: OT Systems and Safety Foundations

An OT cybersecurity engineer needs to connect a diagnostic laptop to a PLC cabinet during a short maintenance window at a wastewater lift station. The cabinet is in an area with electrical hazards, the PLC controls pumps that must remain available unless operations declares the station safe to isolate, and site policy requires operations ownership for any process-impacting work. Which action sequence is the BEST professional decision?

Options:

• A. Apply LOTO immediately, connect the laptop, then notify operations after diagnostics are complete

• B. Hold a safety briefing, complete the JSA, obtain operations approval, apply required PPE and LOTO if isolation is authorized, then connect the laptop

• C. Use PPE, connect through the cabinet switch, and avoid LOTO because the work is cyber-only

• D. Connect the laptop first, verify read-only access, then complete the JSA if changes are needed

Best answer: B

Explanation: Safety control sequencing in OT starts before technical access. The engineer should confirm the work scope, identify hazards through a job safety analysis (JSA), brief affected personnel, and get authorization from operations because operations owns process risk. PPE addresses personal exposure, while LOTO is used only when equipment must be isolated and the authorized process owner approves that isolation. Connecting a cybersecurity tool before these steps can create physical risk, process disruption, or unauthorized interaction with critical control equipment.

The key takeaway is that “cyber-only” work at a live control cabinet still requires safety and operational controls before touching the asset.

• Laptop first fails because even read-only diagnostics can introduce risk before hazards and operational approval are addressed.
• Immediate LOTO fails because isolating pump controls without operations approval can create unacceptable process risk.
• Cyber-only assumption fails because cabinet access and PLC connectivity can still involve electrical hazards and process impact.

Question 45

Topic: OT Security Operations

An OEM technician must connect to an engineering workstation network to diagnose a packaging-line PLC during a 30-minute maintenance window. The PLC controls moving equipment, cannot be rebooted, and cannot run any endpoint agent. Site policy requires preventing unapproved portable devices, malware transfer, and copying production recipes offsite. Which control is the BEST professional decision?

Options:

• A. Allow the OEM laptop after a visitor sign-in.

• B. Use an authorized plant laptop with posture checks and USB controls.

• C. Disable the cabinet port until the next outage.

• D. Require the technician to email recipe files for review.

Best answer: B

Explanation: For OT portable-device security, the safest workable control is to use an approved, dedicated device that can be posture-checked before it touches the OT environment. Because the PLC itself is legacy and cannot run an agent, the control should be applied to the connecting laptop and the physical/network access path. USB controls, authorization, and temporary access reduce malware-transfer and data-loss risk without forcing a PLC reboot or missing the maintenance window. A visitor process alone does not validate device health, and delaying all access may protect the port but fails the operational need when a controlled diagnostic path is available.

• Visitor sign-in only verifies a person’s presence, not the laptop’s security posture or data-transfer controls.
• Emailing recipe files increases data-loss exposure and does not help diagnose the PLC safely.
• Disabling the port blocks unauthorized connection but does not satisfy the required maintenance activity during the available window.

Question 46

Topic: OT Risk Management

A chemical plant is updating its OT risk register before a planned outage. The assessment must prioritize remediation by considering each asset’s criticality, network exposure, plausible threat actors, and operational consequences such as unsafe chemical release or production loss. Which assessment approach best meets this requirement?

Options:

• A. Use a scenario-based OT risk assessment across critical assets and conduits.

• B. Perform a documentation-only maturity assessment of the security program.

• C. Run active vulnerability scans on all controllers and rank by CVSS.

• D. Scope only internet-facing IT assets that share identities with OT.

Best answer: A

Explanation: The best fit is a scenario-based OT risk assessment scoped around critical assets, network conduits, credible threat actors, and operational consequences. This method supports remediation prioritization because it does not treat a vulnerability score as the whole risk. In OT, a lower-severity technical issue on a safety-critical or highly exposed path can outrank a higher-scored issue with little process impact. The assessment should include asset scoping, exposure mapping, threat scenario selection, and consequence analysis tied to the plant’s risk register. The key takeaway is to assess risk in the context of the process, not just the presence of technical findings.

• CVSS-only ranking misses process criticality and safety consequences, and active scans may be unsuitable for fragile controllers.
• Maturity-only review can identify program gaps but does not directly prioritize asset-specific OT risk scenarios.
• IT-only scope misses OT assets, conduits, and process consequences that drive the stated risk decision.

Question 47

Topic: OT Risk Management

An IT security change request proposes deploying a new endpoint agent with automatic host isolation to “all OT assets” in a packaging line. The vendor documentation states the agent supports only Windows hosts. The affected OT inventory includes two Windows HMIs, one Windows engineering workstation, one historian server, and four PLCs running embedded firmware. What is the best applicability decision before testing and approval?

Options:

• A. Reject the entire change because PLCs are in scope

• B. Apply the change only to supported Windows OT hosts and assess isolation behavior

• C. Approve the change for the historian only

• D. Apply the change to every asset listed in the request

Best answer: B

Explanation: Change applicability starts by identifying what is actually being proposed, which assets it can technically affect, and whether the behavior is safe for the OT environment. Here, the change is an endpoint agent with automatic isolation. It applies to Windows-based HMIs, the engineering workstation, and the historian, but not to PLCs running embedded firmware. Because automatic host isolation could remove operator view, engineering access, or historical data collection during production, the feature needs OT-specific testing, stakeholder review, and approval before deployment. Applicability is not the same as blanket approval; it defines the valid asset scope for the change evaluation.

• All assets fails because PLCs running embedded firmware are not supported targets for a Windows endpoint agent.
• Rejecting everything fails because the PLC mismatch does not make the change inapplicable to supported Windows OT hosts.
• Historian only fails because HMIs and the engineering workstation are also supported Windows OT hosts that should be evaluated.

Question 48

Topic: OT Risk Management

A water utility completed an OT cybersecurity maturity assessment using a 1-5 scale. Leadership adopted a benchmark target of level 3 (documented and consistently performed) for each program area supporting critical process areas.

Which implementation choice best addresses the program gap shown by the benchmark?

Options:

• A. Define a vulnerability remediation process with owners, windows, and exception tracking.

• B. Require weekly active vulnerability scans of PLC networks.

• C. Replace the remote access workflow with a new approval portal.

• D. Deploy additional passive monitoring sensors in all OT network zones.

Best answer: A

Explanation: Maturity assessments compare the current state of a program area against a target benchmark. Here, the target is level 3: documented and consistently performed. Asset inventory, remote access, and incident response already meet that target. Vulnerability remediation is at level 2, meaning it is being handled inconsistently or case by case. The best program-management action is to make remediation repeatable by defining ownership, approved maintenance windows, tracking, and exception handling. That closes the maturity gap without assuming an unsafe technical change to live OT assets.

• More sensors may improve visibility, but the measured gap is remediation process maturity, not monitoring coverage.
• Weekly active scanning could create OT availability risk and does not by itself create a documented remediation program.
• New remote access portal targets an area already meeting the benchmark, so it does not address the identified gap.

Question 49

Topic: OT Systems and Safety Foundations

A control engineer is reviewing a packaging line before a scheduled outage. The PLC cannot be replaced this quarter. Which OT security interpretation is best supported by the asset record?

Options:

• A. Multiple legacy and unsupported elements are risk sources needing mitigation.

• B. Modbus/TCP removes the concern about the RS-232 port.

• C. The asset is low risk because the PLC replacement is deferred.

• D. Only the unsupported HMI operating system is relevant.

Best answer: A

Explanation: Legacy and unsupported OT components are risk sources even when the process is stable and replacement is not immediately possible. The record identifies several: an unsupported HMI OS, an accessible programming port, Modbus/TCP traffic that lacks modern security features, and an obsolete HMI runtime with no update path. In an OT environment, the practical response is usually to document the risk and apply compensating controls, such as access control, monitoring, segmentation, port protection, and a planned upgrade path. Deferring replacement does not make the risk disappear; it changes how the risk must be managed until modernization is feasible.

• Deferred replacement does not lower risk; it means the risk needs interim controls and tracking.
• Protocol confusion fails because Ethernet-based control traffic does not protect a separate exposed serial programming port.
• Single-issue focus misses other visible risk sources beyond the unsupported HMI operating system.

Question 50

Topic: OT Risk Management

A water treatment facility identifies a high-severity vulnerability on an unsupported PLC that controls chemical dosing. The vendor patch requires a shutdown and cannot be tested before the next approved maintenance window. Operations wants to defer the patch for 90 days to avoid process disruption, and the cybersecurity engineer is asked to “accept the risk” in the tracking system. Which action is the BEST professional decision?

Options:

• A. Have the cybersecurity engineer accept the risk after adding a ticket note

• B. Let the PLC vendor decide whether the risk is acceptable

• C. Close the finding until the next maintenance window arrives

• D. Route formal risk acceptance to the accountable OT governance authority

Best answer: D

Explanation: Governance structures define who is accountable for OT risk decisions, especially when safety, process continuity, and asset criticality are involved. The cybersecurity engineer can provide evidence, recommend compensating controls, and document residual risk, but formal acceptance of a safety-critical deferral belongs to the designated accountable role or governance body, such as the asset owner, risk committee, or other authority defined by policy. This prevents a technical staff member from informally accepting business, safety, regulatory, and operational consequences they do not own. The key takeaway is that governance does not remove technical input; it assigns decision accountability to the proper authority.

• Engineer-only acceptance fails because a ticket note does not transfer accountability for safety-critical residual risk.
• Vendor decision fails because vendors may advise on technical options, but they do not own the facility’s operational risk.
• Closing the finding fails because deferral still requires documented residual risk, ownership, and approval.

Questions 51-75

Question 51

Topic: OT Security Operations

A vendor advisory reports a remotely exploitable vulnerability in firmware 7.4.x when the controller’s engineering service is reachable. The OT team must decide whether it affects the plant before scheduling downtime. Asset records show three controllers from the vendor, but only one is on firmware 7.4.2; it controls a safety-critical batching process and is reachable from the engineering workstation subnet through an allowed firewall rule. What is the best next triage action?

Options:

• A. Defer action because the controller is not Internet-facing

• B. Prioritize the 7.4.2 controller for remediation planning

• C. Run an active vulnerability scan against all controllers

• D. Patch all controllers from the vendor immediately

Best answer: B

Explanation: OT vulnerability triage should confirm applicability to the actual environment before remediation. Applicability is based on facts such as affected product and firmware, enabled or reachable services, network exposure, process role, and available compensating controls. Here, only the controller on firmware 7.4.2 matches the advisory, and the engineering service is reachable through an allowed conduit. Its safety-critical batching role increases impact, so it should be prioritized for coordinated remediation planning, including testing, downtime, rollback, and operations approval. Not being Internet-facing reduces exposure, but it does not make an OT vulnerability irrelevant when trusted internal paths can reach the affected service.

• Patch everything skips applicability checks and may create unnecessary OT downtime on controllers that do not match the vulnerable firmware.
• Internet-only thinking misses internal OT exposure through engineering workstations and allowed conduits.
• Active scanning first can disrupt fragile controllers and is not needed when inventory and firewall evidence already show applicability.

Question 52

Topic: OT Security Operations

A pharmaceutical plant has an approved maintenance window to calibrate a temperature transmitter used by a safety-critical batch process. The vendor brings a third-party laptop, a handheld calibration tool, a phone, a tablet, USB accessories, and a smartwatch. The handheld calibrator is required for the instrument loop and has been tagged by maintenance; the laptop and mobile devices have unknown posture. Which action is the BEST professional decision?

Options:

• A. Cancel the calibration because any portable device is too risky

• B. Authorize only the tagged calibrator and isolate unneeded mobile/compute devices

• C. Permit the third-party laptop because it belongs to the approved vendor

• D. Allow all vendor devices after the maintenance supervisor signs in

Best answer: B

Explanation: Portable-device risk depends on device type, ownership, purpose, and connection path. A tagged handheld calibration tool needed for an approved instrument activity has a different risk context than an unknown third-party laptop, phone, tablet, USB accessory, or wearable. The safest OT decision is to allow only the device required for the maintenance task under site controls and keep unnecessary compute and mobile devices away from the OT environment. This supports process continuity without expanding the attack surface during a safety-critical maintenance window.

• Vendor trust shortcut fails because vendor ownership does not prove posture, authorization, or safe OT connectivity.
• Broad sign-in approval fails because physical site access is not the same as portable-device authorization.
• Total cancellation fails because the tagged calibrator is needed for approved maintenance and can be controlled without blocking the window.

Question 53

Topic: OT Security Operations

A water utility is planning remediation for an HMI vulnerability. The vendor fix is supported only after the HMI runtime, graphics package, and engineering workstation tools are moved to a specific approved release set. Operations also requires a tested rollback path because the HMI supports a live treatment process. Which remediation planning concept best addresses this requirement?

Options:

• A. Compensating control

• B. Risk acceptance

• C. Mitigating control

• D. Version management

Best answer: D

Explanation: Version management is the best fit when remediation depends on specific software, firmware, or tool versions and their compatibility. In this scenario, the patch cannot be treated as a simple install because the HMI runtime, graphics package, and engineering workstation tools must align to an approved release set. Version management also supports tracking current and target versions, validating dependencies, keeping approved installation media, and defining rollback if the update affects operations. A mitigating control would reduce exploitability while remediation is pending, such as network filtering. A compensating control would provide an alternative control when the primary fix is not feasible. Here, the main need is managing the approved version path for the fix.

• Mitigating control would reduce likelihood or exposure, but it does not manage release compatibility or rollback.
• Compensating control applies when an alternate control meets the objective because the primary remediation cannot be used.
• Risk acceptance documents a decision to tolerate residual risk, which does not satisfy the stated remediation planning need.

Question 54

Topic: OT Cybersecurity Architecture, Design, and Engineering

A food-processing plant is reviewing surveillance results for a packaging-line PLC cabinet after intermittent after-hours alarms. Production is stable, and any inspection must avoid opening energized panels without operations approval.

Exhibit: Surveillance summary

Which interpretation is best supported by the exhibit?

Options:

• A. Treat the PLC cabinet lock as the primary failure

• B. Prioritize firewall tuning for the PLC subnet

• C. Suspect an unauthorized wireless device near the south wall

• D. Attribute the alarms to normal operator activity

Best answer: C

Explanation: Physical surveillance methods are strongest when their findings correlate. Here, the walkdown found a new unlabeled device, motion and video place activity near the south perimeter, and spectrum analysis shows RF bursts from the same area at the same time. Because there is no cabinet-door motion and production is stable, the best interpretation is a suspected unauthorized wireless device or transmitter near the south wall. The next physical-security work should be coordinated with operations and safety procedures before touching energized areas or removing equipment.

The key takeaway is to use multiple surveillance sources to locate and validate a physical security concern before jumping to a cyber-only fix.

• Cabinet lock focus fails because the exhibit shows no cabinet-door motion or direct evidence of cabinet entry.
• Normal operator activity fails because the activity occurred after hours and involved an unlabeled device plus unexplained RF bursts.
• Firewall tuning may be useful later, but the decisive evidence points to a physical wireless source first.

Question 55

Topic: OT Cybersecurity Architecture, Design, and Engineering

An OT security engineer is selecting access control for an unmanned compressor control room. Which system best matches the facility control needs shown in the exhibit?

Options:

• A. Wall badge reader on a standard door strike

• B. Proximity badge reader with a full-height turnstile

• C. Fingerprint biometric reader at the room door

• D. Supervisor-controlled shared mechanical key cabinet

Best answer: B

Explanation: The core concept is matching the physical access control mechanism to the facility need. The exhibit requires both individual audit logging and one-person-per-authorization entry. A proximity badge or fob reader provides an electronic identity event, while a full-height turnstile helps prevent tailgating better than a standard controlled door. The PPE constraint also makes fingerprint biometrics a weaker fit because gloves and dirty hands can interfere with reliable use. Emergency egress still needs to be designed into the installation, but the turnstile-and-reader combination best satisfies the stated control goals.

• Standard door reader logs badge use but does not strongly prevent tailgating through a single opened door.
• Fingerprint biometrics can provide identity assurance, but gloves and industrial work conditions make it less suitable here.
• Shared mechanical keys weaken individual accountability and do not provide electronic entry logs.

Question 56

Topic: OT Threat Intelligence

An OT SOC receives an ISAC advisory and must determine whether related activity has appeared in the OT network or IDMZ. The plant manager requires no active probing of controllers during production.

IOC types: SHA-256 hashes, malicious domains, external IPs
Other clues: suspicious usernames, abnormal process names, unusual VPN sessions
Available sources: DNS proxy, firewall, jump-box EDR, AAA/VPN logs, OT-aware IDS metadata

Which implementation choice best supports this monitoring need?

Options:

• A. Search only HMI event logs for suspicious usernames

• B. Correlate IOC watchlists across passive logs and alert on validated matches

• C. Block all advisory IPs directly on the PLC VLAN firewall

• D. Run credentialed vulnerability scans against all PLCs during the shift

Best answer: B

Explanation: IOC analysis in OT should use the available evidence sources that correspond to each indicator type while respecting operational constraints. Hashes and abnormal processes fit endpoint telemetry such as jump-box EDR. Domains fit DNS proxy logs. External IPs fit firewall and IDS metadata. Usernames and unusual sessions fit AAA and VPN logs. Correlating these indicators in a SIEM, TIP, or OT monitoring workflow provides coverage without active scans or changes to controllers during production.

The key is to match each IOC to the safest relevant data source, then validate hits in context before escalating.

• Active scanning violates the stated production constraint and can create unnecessary risk for controllers.
• Direct IP blocking may be useful after validation, but it does not analyze hashes, domains, users, processes, or sessions.
• HMI-only searching misses most listed IOC types and ignores stronger sources such as DNS, firewall, EDR, and AAA logs.

Question 57

Topic: OT Threat Intelligence

A regional water utility is classifying threat-intelligence intake before adding it to the OT risk register. Based on the exhibit, which collection note should be labeled as measurement and signature intelligence (MASINT)?

Exhibit: Threat-intelligence intake

Options:

• A. Pump vibration signature matching cavitation

• B. Unknown 900 MHz telemetry bursts

• C. Operator interview about RTU cabinets

• D. Vendor advisory and public forum post

Best answer: A

Explanation: Measurement and signature intelligence (MASINT) is based on technical measurements of physical phenomena or signatures. In this OT scenario, the pump vibration pattern is a measured equipment signature, so it fits MASINT. The operator interview is human intelligence (HUMINT). The RF telemetry capture is signals intelligence (SIGINT) because it comes from electromagnetic communications. The vendor advisory and public forum post are open-source intelligence (OSINT). The satellite image in the exhibit is imagery intelligence (IMINT), even though it may support the same investigation. The key distinction is the source and collection method, not whether the information is useful to OT defenders.

• Interview source is HUMINT because it comes from a person reporting observed behavior.
• RF capture is SIGINT because it is collected from radio-frequency communications or emissions.
• Public sources are OSINT because vendor advisories and forum posts are openly available materials.

Question 58

Topic: OT Risk Management

A municipal water utility is reviewing a risk decision for an unsupported PLC that controls chlorine dosing. A compensating firewall rule is available now, but the PLC firmware update requires a reboot during the monthly maintenance window. The plant must maintain permitted disinfection levels, meet a reliability target for continuous treatment, and obtain operations approval for any process interruption. Which recommendation is the BEST professional decision?

Options:

• A. Accept the risk because the firewall rule reduces network exposure

• B. Transfer the risk to the PLC vendor under the support agreement

• C. Apply the firmware update immediately to remove the vulnerability

• D. Revise the risk decision to include legal, reliability, and operations requirements before approval

Best answer: D

Explanation: OT risk decisions must represent more than cybersecurity severity. In this scenario, the decision must account for permitted disinfection levels, reliability expectations for continuous treatment, and the operations owner’s authority over process interruptions. A compensating firewall rule may be appropriate short term, and the firmware update may be appropriate during the maintenance window, but the risk record and approval path need to show those constraints explicitly. That makes the decision traceable to legal, reliability, and operational requirements instead of treating the issue as only a technical vulnerability.

• Exposure-only acceptance fails because reduced network exposure does not address permit obligations, treatment continuity, or operations approval.
• Immediate patching fails because rebooting the PLC during production could disrupt a safety- and compliance-relevant process.
• Vendor transfer fails because support terms do not remove the utility’s responsibility for legal compliance and operational risk ownership.

Question 59

Topic: OT Systems and Safety Foundations

A controls engineer is reviewing Ethernet traffic before adding monitoring rules for a packaging cell. Which OT Ethernet protocol is most directly indicated by the evidence?

Exhibit: Packet summary

Options:

• A. Profinet

• B. CIP/EtherNet/IP

• C. OPC UA

• D. Modbus TCP

Best answer: B

Explanation: EtherNet/IP uses the Common Industrial Protocol (CIP) over standard Ethernet/IP networks. In OT traffic, TCP port 44818 is commonly associated with EtherNet/IP explicit messaging, while UDP port 2222 is commonly associated with implicit, cyclic I/O traffic between controllers and field devices. The exhibit also names CIP object data, which reinforces the identification.

Modbus TCP would more typically center on Modbus function codes over TCP 502. OPC UA is usually used for platform-independent data exchange rather than controller-to-remote-I/O cyclic control traffic. Profinet is also Ethernet-based, but the visible CIP and port evidence points away from it.

• Modbus TCP trap fails because the exhibit does not show TCP 502 or Modbus function-code style evidence.
• OPC UA trap fails because OPC UA is not indicated by CIP object data or UDP 2222 cyclic I/O.
• Profinet trap fails because it is Ethernet-based OT, but the shown CIP/EtherNet/IP indicators are more specific.

Question 60

Topic: OT Cybersecurity Architecture, Design, and Engineering

A chemical blending facility has an IDF cabinet in an unlocked maintenance corridor used by contractors. The cabinet serves safety-related PLC network uplinks and several exposed copper patch cables in an overhead tray. Operations will not approve downtime or cable rerouting until a planned outage in 4 months, and maintenance must retain emergency access. Which physical security approach is the BEST professional decision?

Options:

• A. Seal the cabinet shut and remove maintenance access

• B. Relocate the IDF immediately to the control room

• C. Disable the IDF switch ports until the outage window

• D. Add a lockable cabinet, cable protection, tamper evidence, and monitored access

Best answer: D

Explanation: Physical security for OT rooms, cabinets, and cabling should match the exposure without creating unsafe operational side effects. Here, the IDF is in a contractor-accessible corridor, supports safety-related PLC connectivity, and cannot be moved or interrupted before the outage. A layered physical control set is appropriate: a lockable cabinet or enclosure, protected or covered cable paths, tamper-evident indicators, and monitored/logged access such as badges, keys under control, cameras, or motion detection. Emergency access can be preserved through an approved break-glass or maintenance procedure. The key is reducing casual or malicious physical access while keeping the OT network available.

• Port shutdown creates an availability and safety risk because the cabinet supports PLC network uplinks.
• Immediate relocation ignores the no-downtime and no-rerouting constraints before the planned outage.
• Sealing access may protect the cabinet but conflicts with required emergency maintenance access.

Question 61

Topic: OT Security Operations

A chemical plant is revising portable-device controls for maintenance work in a controller cabinet. A vendor technician brings an unmanaged laptop to run diagnostic software, a USB calibration interface for field instruments, a personal phone, and a smartwatch. The plant must allow the maintenance task but prevent unmanaged devices from creating an unmonitored path into the OT cell. Which implementation choice best matches the device risk context?

Options:

• A. Treat all items as accessories and allow them if the technician is escorted.

• B. Permit direct cabinet network access because the laptop is used only for maintenance.

• C. Use a posture-checked jump path for the laptop, log the calibration interface, and keep personal mobile/wearable devices out of the cabinet area.

• D. Enroll the laptop, phone, and smartwatch as corporate-owned devices for the visit.

Best answer: C

Explanation: Portable-device handling should follow the device’s role and ownership. A third-party laptop is an unmanaged compute device with higher risk because it can store tools, bridge networks, or introduce malware, so it should use a controlled, monitored access path such as a posture check, jump box, and time-bound authorization. Calibration equipment has a specific maintenance function and should be authorized and tracked, but it is not the same risk category as a general-purpose laptop. Personal phones and wearables can introduce cameras, radios, storage, or unapproved connectivity, so they should be restricted where cabinet access and OT proximity create risk. The key is to apply controls by risk context, not by convenience or escort status alone.

• Escort-only access fails because physical supervision does not address unmanaged compute, wireless, or removable-media risk.
• Corporate enrollment fails because a short-term vendor device should not be reclassified as corporate-owned without ownership and lifecycle control.
• Maintenance purpose fails because legitimate use does not make direct OT network access safe or monitored.

Question 62

Topic: OT Security Operations

An OT SOC is tuning SIEM rules for an engineering workstation. The goal is to detect when an authenticated account actually performs a PLC download, while reducing false positives from normal logons or malware scans.

Exhibit: Log excerpt

Which SIEM correlation should be implemented first?

Options:

• A. Alert on application download events without user/session correlation

• B. Alert on the OS interactive logon to the engineering workstation

• C. Correlate identity/OS logon, EDR launch, and app download by user/host

• D. Alert on any EPP event reporting no malware on the workstation

Best answer: C

Explanation: Host and security log analysis is strongest when related events are correlated across sources. In this scenario, the identity and OS logs show who authenticated and where the session occurred. The EDR log shows the engineering application was launched on the workstation. The application log shows the operationally significant action, a project download to the PLC. Combining these events by user, host, and close timing provides both confidence and accountability. A single log source can be useful, but it may not prove that an authenticated user both accessed the workstation and performed the control-system action.

• EPP clean result is not evidence of a PLC download; it only reports malware scan status.
• OS logon alone proves access to the workstation, not use of engineering software or a PLC change.
• Application-only alerting may detect downloads, but it lacks stronger identity/session context for attribution.

Question 63

Topic: OT Security Operations

A food packaging site is triaging a new vulnerability notice for a PLC family. The PLC controls a conveyor interlock; an unplanned reboot stops the line and requires safety validation before restart.

Triage facts:

Which prioritization action best accounts for these facts?

Options:

• A. Patch immediately during production because the public exploit exists

• B. Rank high, add temporary conduit restrictions, and schedule a tested update window

• C. Defer remediation because the PLC is not internet-facing

• D. Close the finding until an active exploit is observed onsite

Best answer: B

Explanation: OT vulnerability prioritization should combine technical severity with OT-specific context. Here, the vendor confirms applicability, a public exploit exists, and the vulnerable service is reachable from an engineering subnet, so the issue should not be dismissed. However, the PLC supports a process interlock and the update requires a controlled outage, so immediate unscheduled patching could create operational or safety risk. A strong action is to prioritize the vulnerability, reduce exposure with a temporary conduit restriction or similar compensating control, and schedule a tested update with operations, rollback, and process validation.

• Patch immediately ignores the stated process impact and safety validation requirement.
• Not internet-facing is not enough to defer because the vulnerable service is reachable from an internal engineering subnet.
• Wait for onsite exploitation fails because exploitability and exposure are already supported by evidence.

Question 64

Topic: OT Systems and Safety Foundations

A plant is configuring an HMI alarm for a tank heating loop. The alarm should avoid nuisance alerts during normal warm-up but alert if the process does not reach the target within the allowed time.

Exhibit: Current tag values

Which monitoring implementation best matches the evidence?

Options:

• A. Disable the watchdog while the heat-up timer is active.

• B. Suppress deviation alarm until Heatup_Timer.DN is true.

• C. Alarm immediately because Temp_CV is below Temp_SP.

• D. Declare a PLC communications fault from the temperature gap.

Best answer: B

Explanation: The key is interpreting the process value in context. Temp_CV is 72°C and Temp_SP is 80°C, so the loop has not reached target. However, the heat-up timer is enabled and not done (ACC=180s, PRE=300s), meaning the allowed warm-up period has not expired. The watchdog is healthy, so the visible tags are still trustworthy. For this state, the deviation is expected, not abnormal. The alarm should evaluate the deviation after the timer completes, rather than alerting immediately during normal warm-up.

• Immediate alarm ignores the timer evidence that the process is still within its allowed warm-up period.
• Communication fault is not supported because the watchdog reports healthy tag updates.
• Watchdog disablement removes a health check and does not solve process-deviation logic.

Question 65

Topic: OT Cybersecurity Architecture, Design, and Engineering

A plant is hardening an engineering workstation used to update PLC logic during approved maintenance windows. Operations wants to keep vendor support intact and avoid changing traffic rules or anti-malware policy in this phase. Based on the finding, which host security technology best addresses the requirement?

Exhibit: Access-control finding

Asset: EW-07 engineering workstation
Finding: All controls engineers are local administrators
Vendor tool: needs admin rights only for driver updates
Requirement: remove standing admin, allow approved elevation, log each elevation reason

Options:

• A. HIDS

• B. EPM

• C. EDR

• D. Host-based firewall

Best answer: B

Explanation: Endpoint privilege management (EPM) controls how users receive elevated rights on a host. In this case, the problem is not network filtering, malware prevention, or threat response. The workstation has too many standing local administrators, but the vendor tool occasionally needs admin rights for a specific maintenance task. EPM can remove persistent admin membership, grant approved elevation only when needed, and record the reason for the elevation. That supports least privilege without changing PLC traffic flows or anti-malware behavior.

• Firewall focus fails because the requirement is privilege elevation, not allowing or blocking host network connections.
• Integrity monitoring is not the main need because the exhibit does not ask to alert on unauthorized file or configuration changes.
• Detection and response is broader than needed because the requirement is controlled admin elevation, not endpoint investigation or automated response.

Question 66

Topic: OT Incident Management

A packaging line reports a malware alert on an engineering workstation after a vendor support session. The workstation is not needed for current automatic operation. PLCs are running normally, operators still have HMI view/control, and the site wants to avoid an unnecessary shutdown while preserving evidence. Which implementation choice best supports safe containment, eradication, and recovery?

Options:

• A. Power-cycle the PLCs to clear possible malicious logic.

• B. Block all HMI-to-PLC traffic until the investigation ends.

• C. Quarantine the workstation, then rebuild and validate it offline.

• D. Reimage the workstation directly on the production network.

Best answer: C

Explanation: Safe OT incident handling separates the affected component from the running control process when possible. Here, the engineering workstation is suspicious but not required for current automatic operation, while the PLCs and HMI are still supporting normal production. Quarantining the workstation limits spread and preserves operational control. Rebuilding and validating it offline supports eradication and recovery without introducing an untested host back into the control network. The key is to avoid actions that unnecessarily remove operator view/control or disturb stable controller operation unless safety conditions require it.

• PLC restart is risky because it can disrupt a stable process and does not target the workstation alert.
• Blocking HMI traffic removes operator view/control even though the process is currently stable.
• Production reimage can reintroduce risk because recovery has not been validated before reconnection.

Question 67

Topic: OT Incident Management

During an OT incident response at a chemical batching facility, the team has confirmed unauthorized remote access to an engineering workstation. The affected workstation is isolated, the remote access conduit is blocked, and operators report the process is stable in manual mode. The incident commander asks for the next PICERL-aligned activity before returning the workstation to service. Which action best fits the current incident handling state?

Options:

• A. Identify by collecting initial alerts and declaring an incident

• B. Contain by isolating the workstation and blocking the conduit

• C. Eradicate by removing persistence and resetting compromised credentials

• D. Recover by reconnecting the workstation and resuming normal operations

Best answer: C

Explanation: PICERL maps incident response work to Prepare, Identify, Contain, Eradicate, Recover, and Lessons Learned. In this scenario, the team has already identified the incident and completed containment actions: the affected workstation is isolated, the conduit is blocked, and operations are stable. The next phase is eradication, which removes the root cause and attacker foothold, such as malware, persistence mechanisms, unauthorized tools, and compromised credentials. Only after eradication should recovery actions restore systems, reconnect assets, and validate safe process operation. In OT, that order matters because restoring too early can reintroduce compromise into a live control environment.

• Initial triage is already complete because unauthorized access has been confirmed and response actions are underway.
• More containment repeats actions already stated in the scenario rather than addressing the remaining foothold.
• Immediate recovery is premature because reconnecting before removing persistence can restore the attacker’s access.

Question 68

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water utility operates unmanned pump stations with PLCs in locked roadside cabinets. Two cabinets recently showed broken mechanical seals after hours, but no unauthorized network traffic was observed. Operations will not approve PLC firmware changes or reboots until the annual outage, and the primary requirement is to alert on future physical access without interrupting pumping. Which hardware security control is the BEST professional decision?

Options:

• A. Enable full-disk encryption on engineering workstations

• B. Require Secure Boot on replacement PLCs

• C. Deploy a hardware root of trust in the PLC platform

• D. Add cabinet tamper switches and tamper-evident seals

Best answer: D

Explanation: The core risk is unauthorized physical access to remote OT cabinets, with a requirement for immediate alerting and no disruption to pumping. Tamper detection controls, such as cabinet door switches, chassis-open sensors, and tamper-evident seals, are designed to reveal or report physical access attempts. They can often be implemented around the asset or cabinet without changing PLC logic, firmware, or boot behavior. Drive encryption protects data at rest on endpoints if a device is lost or stolen. Secure Boot and root of trust help verify trusted boot and hardware/software integrity, but they usually involve platform support, configuration changes, or lifecycle planning. The key takeaway is to match the control to the risk: physical access evidence and alerting calls for tamper detection.

• Drive encryption protects stored data, but it does not detect cabinet entry or unauthorized physical access to PLC hardware.
• Secure Boot improves boot integrity, but replacement PLC requirements do not meet the near-term, no-reboot alerting need.
• Root of trust supports platform integrity, but it is not the most direct control for detecting after-hours cabinet access.

Question 69

Topic: OT Cybersecurity Architecture, Design, and Engineering

A water treatment facility is preparing to move a vendor-packaged chemical dosing skid from staging into the OT production network. The controls engineer provides the following commissioning note.

Exhibit: Commissioning note

What is the best next action before production connection?

Options:

• A. Keep the defaults and rely on subnet filtering

• B. Delay changes until the next maintenance outage

• C. Change the vendor-default passwords to unique managed credentials

• D. Document the defaults in the asset record only

Best answer: C

Explanation: Vendor-default or inherited credentials are a common OT access-control weakness because they may be known across sites, manuals, contractors, and repeated equipment packages. In this case, the credentials are visibly default, reused across all skids, and the HMI has a permitted path to the engineering workstation subnet. The safest time to correct the issue is while the skid is still in staging, before it is connected to production. The action should replace defaults with unique managed credentials, update authorized access records, and preserve vendor support through approved credential management rather than shared defaults. Network filtering helps, but it does not remove the credential weakness.

• Subnet filtering alone reduces exposure but does not fix known shared credentials on the skid.
• Documentation only records the risk but leaves default access available.
• Waiting for an outage is unnecessary because the equipment is still in staging with no downtime impact.

Question 70

Topic: OT Incident Management

A manufacturing site declares a cyber incident after abnormal HMI behavior on a packaging line. The line is still producing within safety limits, but the cause is unknown. Review the coordination board.

What is the best next action to coordinate responsibilities?

Options:

• A. Have maintenance power-cycle the controller to clear the fault

• B. Let engineering reload the last known-good PLC program

• C. Use unified incident command and assign team actions by authority

• D. Allow IT to isolate all Windows hosts immediately

Best answer: C

Explanation: OT incident management requires coordinated command, not isolated team actions. In this scenario, operations owns production and safety decisions, engineering must approve control logic changes, maintenance must follow clearance and LOTO requirements, IT can support enterprise containment, and OT security can contain the IT-to-OT path while preserving evidence. A unified incident command or similar coordinated structure assigns responsibilities, prevents unsafe unilateral actions, and keeps containment aligned with process safety and evidence needs.

The key takeaway is that OT response coordination should respect operational authority and safety constraints before disruptive technical actions are taken.

• IT-led isolation fails because isolating HMIs or other Windows hosts could affect OT visibility or control without operations and OT approval.
• Power-cycling equipment fails because it is a disruptive maintenance action that requires operations clearance and may destroy evidence.
• Reloading PLC logic fails because engineering has not completed validation, and changing controller logic is not the first coordination step.

Question 71

Topic: OT Systems and Safety Foundations

A chemical batching skid uses PLC tag TT-204.PV for the current reactor temperature and TT-204.SP for the recipe set point. Normal controller oscillation is within ±2 °C. OT monitoring must flag abnormal process behavior while minimizing nuisance alerts. Which implementation choice best meets this need?

Options:

• A. Alert when TT-204.PV deviates from TT-204.SP by more than 2 °C for a short persistence window.

• B. Alert whenever TT-204.PV changes from its previous sample.

• C. Alert whenever TT-204.SP is modified by the recipe system.

• D. Alert only when TT-204.PV reaches the equipment maximum rating.

Best answer: A

Explanation: For process-abnormality monitoring, the key comparison is the current process value against the expected set point. A temperature value can change normally as the controller corrects toward the set point, so alerting on every movement creates noise. The stated normal oscillation is ±2 °C, so the monitor should use that band and require the deviation to persist briefly before treating it as abnormal. This catches conditions where the process is not tracking the recipe while avoiding alerts for expected control action.

• Sample-to-sample change is too sensitive because normal closed-loop control causes frequent process value movement.
• Set point modification may be a normal recipe action and does not prove the process is behaving abnormally.
• Maximum rating only can miss abnormal deviation from the recipe long before a safety or equipment limit is reached.

Question 72

Topic: OT Incident Management

A water treatment facility wants to validate incident-response decision-making for a suspected ransomware event affecting an engineering workstation. Operations leadership will not permit any activity that changes PLC logic, blocks production traffic, or interrupts operator view during peak demand.

Exhibit: Exercise planning note

Which exercise type best fits the note?

Options:

• A. Full-scale production failover drill

• B. Unannounced adversarial emulation on OT hosts

• C. Live PLC shutdown recovery exercise

• D. Tabletop exercise

Best answer: D

Explanation: A tabletop exercise is the best fit when the objective is to validate decision-making without disrupting production operations. It is discussion-based and uses scenario injects to walk participants through escalation, communications, safety decisions, shutdown criteria, and coordination across OT, IT, and management. The exhibit explicitly prohibits changes to live control systems or network paths, so hands-on actions against production assets would violate the constraint. More operational exercises can be valuable later, but they require tighter controls, test environments, or approved outage windows.

The key takeaway is to match the exercise type to the validation goal and the allowed operational impact.

• Production failover may test resilience, but it can affect live operations and is broader than decision validation.
• Adversarial emulation can validate defenses, but running it unannounced on OT hosts risks disruption and stakeholder misalignment.
• PLC shutdown recovery directly interacts with control operations and conflicts with the no-impact constraint.

Question 73

Topic: OT Security Operations

A water treatment plant SOC concludes that a legacy engineering workstation attempted an unauthorized program write to a PLC during production. Operations will not allow active scans or controller access until the next maintenance window, and the PLC provides no local security logs. Which data source would best validate the conclusion now?

Options:

• A. Firewall accept logs for the engineering workstation connection

• B. Historian trend data for process variable changes

• C. OT-aware IDS packet evidence decoding PLC function codes

• D. CMDB ownership records for the PLC and workstation

Best answer: C

Explanation: The strongest validation source is passive network evidence that understands the control protocol. An OT-aware IDS or packet capture can show whether the engineering workstation actually sent a program-write or similar function code to the PLC, while preserving process continuity because it does not require scanning or logging into the controller. This directly tests the SOC conclusion: unauthorized workstation, target PLC, time, and command type. Historian data may show process effects, but it usually cannot prove who issued a control command or whether it was a program write. Firewall logs can prove a session was allowed, not what control-system operation occurred. Asset records help with ownership and scoping, not event validation.

• Historian-only validation fails because process trends may show impact but not the command source or PLC function code.
• Firewall connection evidence fails because allowed traffic does not prove a program-write operation occurred.
• CMDB records fail because ownership and asset context do not validate the security event itself.

Question 74

Topic: OT Incident Management

A chemical plant must validate whether its OT incident response team can make correct shutdown, isolation, escalation, and notification decisions during a suspected controller compromise. The production line runs 24/7, the affected unit includes a safety instrumented system, and there is no approved change window for testing on live assets. Which exercise type is the BEST professional decision?

Options:

• A. Adversarial emulation against live PLCs

• B. Full-scale failover test of the production DCS

• C. Unannounced live containment drill on the production network

• D. Facilitated tabletop exercise using the OT IR playbook

Best answer: D

Explanation: The core concept is selecting an exercise type that tests decision quality while preserving OT safety and process continuity. A facilitated tabletop exercise is designed for this situation: stakeholders walk through a realistic scenario, use the incident response plan, apply decision matrices, and validate roles, communications, shutdown criteria, and notification steps. It does not require blocking traffic, changing controller logic, forcing failover, or interacting with safety-critical production assets. In OT environments, higher-fidelity exercises can be valuable, but they require approval, engineering safeguards, and a safe test environment or change window. With 24/7 operations, a SIS, and no approved production testing window, tabletop validation is the safest fit.

• Live containment is too disruptive because blocking production traffic without an approved window can affect control and visibility.
• Production failover may validate resilience, but it changes operational state and needs formal engineering approval and a change window.
• Live PLC emulation introduces unnecessary operational and safety risk when the objective is decision-making validation.

Question 75

Topic: OT Security Operations

During routine monitoring at a water treatment site, there is no approved maintenance window or change ticket. The control VLAN permits Modbus/TCP only between the HMI and the PLC. Which interpretation is best supported by the exhibit?

Exhibit:

Topology: Corporate IT -> IDMZ historian -> OT firewall -> Control VLAN 30
Approved Modbus/TCP: HMI 10.30.4.20 -> PLC 10.30.4.11

09:12  Switch SW-OT-2: link up Gi1/0/18, MAC 00:25:90:ab:41:77
09:13  DHCP: 10.30.4.88 assigned on VLAN 30
09:14  IDS: 10.30.4.88 -> 10.30.4.11 Modbus/TCP func 16
09:14  FW: 10.30.4.88 -> 10.30.10.15 TCP/445 denied

Options:

• A. The HMI performed normal Modbus polling.

• B. An unauthorized device attempted PLC write activity.

• C. The firewall caused a process communication outage.

• D. The historian initiated approved collection traffic.

Best answer: B

Explanation: The key evidence is the sequence across multiple monitoring sources. A new MAC address appeared on an OT switch port, received an address on the control VLAN, and then sent Modbus/TCP function 16 traffic to the PLC. Function 16 is a write operation, and the source is not the approved HMI address. The denied SMB attempt toward the IDMZ historian is additional suspicious boundary evidence, but the most important OT security meaning is unauthorized device activity in the control VLAN with attempted PLC write behavior. A safety-aware response would involve OT operations before containment actions that could affect the process.

• Historian traffic fails because the log shows traffic from the control VLAN host, not from the IDMZ historian into the control network.
• Normal polling fails because the source is not the approved HMI and function 16 is a write, not routine read polling.
• Firewall outage fails because the decisive event is unauthorized PLC-directed traffic; the SMB denial does not prove a process outage.

Questions 76-90

Question 76

Topic: OT Risk Management

A water utility is reviewing an OT risk before approving the quarterly treatment plan. Based on the risk register excerpt, which risk disposition is most appropriate?

Exhibit: Risk register excerpt

Options:

• A. Transfer the risk

• B. Mitigate the risk

• C. Avoid the risk

• D. Accept the risk

Best answer: B

Explanation: Risk mitigation is the appropriate disposition when the organization reduces likelihood or impact with controls while continuing the activity. The exhibit states the current risk is High, above the Medium risk appetite, so simple acceptance is not justified. The skid must continue running and vendor diagnostics are required, so avoiding the risk by stopping the activity or removing the exposure entirely is not practical under the stated constraint. Transfer would address financial or contractual exposure, but it would not reduce the OT safety and operational risk. The listed jump box, MFA, command allowlisting, and function-code monitoring are compensating controls intended to bring residual risk down to Medium.

• Acceptance mismatch fails because the current High rating exceeds the stated risk appetite.
• Transfer misconception fails because insurance or contracts do not reduce unauthorized OT command likelihood or impact.
• Avoidance mismatch fails because the process and vendor diagnostic access must continue until the planned outage.

Question 77

Topic: OT Cybersecurity Architecture, Design, and Engineering

A manufacturing site is adding internal network security monitoring for a packaging cell. The OT network must not be actively scanned during production, and engineers need to detect new communications between the HMI, PLCs, historian, and engineering workstation. They also want enough context to tune alerts against normal operations. Which implementation choice best meets these requirements?

Options:

• A. Run scheduled active discovery scans across the cell network

• B. Rely on host EDR alerts from the engineering workstation

• C. Use passive traffic sensors, flow records, centralized logs, and baselines

• D. Collect full packet captures only during suspected incidents

Best answer: C

Explanation: Internal network security monitoring in OT should favor passive and correlated visibility when production disruption is a concern. Passive traffic collection from taps or SPAN ports can observe ICS protocols without probing devices. Flow collection summarizes who talked to whom, when, and how much, which helps identify new or unexpected conduits. Log aggregation from switches, firewalls, IDS sensors, servers, and access systems provides context for correlation. Baselining then defines normal HMI, PLC, historian, and engineering workstation behavior so alerts can be tuned to deviations instead of generic noise.

The key is using multiple evidence sources without introducing active traffic that could affect fragile or deterministic OT assets.

• Active scans may improve inventory detail, but they violate the production constraint and can disrupt sensitive OT devices.
• Incident-only packet capture misses ongoing visibility and does not establish normal communication patterns.
• Single-host EDR can help on the engineering workstation, but it cannot monitor PLC-to-HMI or network-wide conduit behavior.

Question 78

Topic: OT Incident Management

A water treatment facility activates its ICS4ICS-based incident response plan after operators lose reliable view of one remote pump station. The Incident Commander has approved a unified response structure.

Exhibit: Initial response roster

Which ICS/ICS4ICS role should fill the unassigned need?

Options:

• A. Operations Section Chief

• B. Logistics Section Chief

• C. Liaison Officer

• D. Public Information Officer

Best answer: C

Explanation: ICS and ICS4ICS use a structured command model so industrial incident response can coordinate safety, operations, cybersecurity, vendors, and outside agencies without bypassing the Incident Commander. In this exhibit, the unassigned need is not media communication, resource procurement, or hands-on containment. It is coordination with outside representatives such as an OEM, utility mutual-aid team, and state cyber agency. That maps to the Liaison Officer role, which serves as the point of contact for assisting and cooperating organizations. The Operations Section focuses on tactical response work, while Planning tracks status and the incident action plan.

• Public messaging is handled by the Public Information Officer, not by the role coordinating agency representatives.
• Resource support is a Logistics function, but the exhibit asks for inter-organization coordination rather than supplies or services.
• Tactical containment belongs under Operations, but the control systems lead is already assigned to response actions.

Question 79

Topic: OT Incident Management

A chemical blending site suspects an OT cyber incident. Operations reports stable production, but the IR lead must identify the affected assets and choose a safe containment point before making network changes.

Exhibit: Initial incident note

Which data set best supports scoping and containment planning?

Options:

• A. Operator shift turnover notes for the blending unit

• B. Conduit firewall logs and packet captures around PLC-7

• C. The latest PLC-7 firmware image backup

• D. Corporate email gateway quarantine logs

Best answer: B

Explanation: For scoping an OT incident, the most useful data set is the one that shows what communicated with the suspected affected asset and across which conduit. The exhibit already points to a Modbus write from an engineering workstation VLAN to PLC-7, and the safety note warns against direct isolation without coordination. Firewall logs, flow records, and packet captures around that conduit help determine source, destination, function codes, timing, and whether other controllers or HMIs were involved. That evidence supports a containment decision such as blocking a specific path or account while avoiding broad changes that could disrupt production. Backups and operator notes may help later, but they do not map the active network scope.

• Firmware backup helps recovery or comparison, but it does not show the live communication path that caused the alert.
• Shift notes can confirm whether a change was authorized, but they do not identify affected network assets.
• Email quarantine may support phishing investigation, but the exhibit points to OT conduit activity that must be scoped first.

Question 80

Topic: OT Incident Management

A chemical plant is investigating an OT incident involving an engineering workstation that may have exported unauthorized PLC logic. The findings may be used for insurance and regulatory reporting. Which implementation choice best preserves the evidence for later forensic or legal use?

Options:

• A. Let the PLC vendor examine the workstation before documentation

• B. Copy the project files to a shared incident folder

• C. Label evidence, document handling, hash copies, and secure storage

• D. Reimage the workstation after collecting screenshots

Best answer: C

Explanation: Chain of custody is the process used when evidence may need to support legal, regulatory, insurance, or forensic decisions. In an OT incident, the team should identify the evidence, record who collected it and when, preserve integrity with hashes for forensic copies where applicable, document each transfer, and store it securely with access control. This does not prevent incident response, but it adds discipline so later reviewers can trust that the evidence was not altered or mishandled. The key takeaway is to preserve both the evidence and the history of its handling.

• Shared folder copying may help collaboration, but it does not prove integrity or controlled possession.
• Vendor-first handling can contaminate the evidence trail if possession and actions are not documented first.
• Reimaging quickly may support recovery, but it destroys or alters evidence before proper preservation.

Question 81

Topic: OT Security Operations

A manufacturing site allows vendor technicians to bring files into an OT cell for PLC maintenance. The OT manager wants the control that best reduces unauthorized media use, malware transfer, and loss of recipe files.

Exhibit: Portable-device control checklist

Options:

• A. Require vendors to sign an annual acceptable-use acknowledgment

• B. Add a firewall rule blocking vendor laptops from the PLC subnet

• C. Deploy a removable-media kiosk with scanning, authorization, logging, and approved encrypted media

• D. Enable passive asset discovery on the OT switch mirror port

Best answer: C

Explanation: The exhibit points to removable media as the active gap: personal USB drives are used directly on the engineering workstation, scanning happens outside the OT workflow, transfers are not logged, and recipe exports are not controlled. A dedicated removable-media kiosk or transfer station can enforce the workflow before media reaches OT assets. It can scan files with approved tools, allow only authorized media, record custody and transfer details, and require encrypted or controlled media for sensitive exports.

Network controls still matter, but the exhibit already says vendor laptops are not allowed on OT switch ports. The highest-value next control must govern the actual transfer path being used: USB media at the engineering workstation.

• Firewall focus misses the stated gap because vendor laptops are already barred from OT switch ports, while USB remains uncontrolled.
• Policy acknowledgment supports governance but does not technically prevent malware transfer or recipe data loss.
• Passive discovery may improve visibility, but it does not control removable-media use or file movement.

Question 82

Topic: OT Systems and Safety Foundations

A packaging plant is modernizing an OT cell that uses legacy PLCs and a separate SIS. The line has a quarterly 2-hour maintenance window, and operations will not approve changes that could alter deterministic control timing. The engineering team wants to use virtualization to reduce aging workstation hardware while preserving process continuity. Which design is the BEST professional decision?

Options:

• A. Bridge the virtual switch directly to the enterprise user network

• B. Replace the SIS controller with a virtual PLC during the maintenance window

• C. Move PLC scan logic into containers on shared industrial PCs

• D. Virtualize HMI, historian, and engineering workstations on an OT hypervisor cluster

Best answer: D

Explanation: Virtualization in OT is most appropriate for workloads that can tolerate the abstraction layer, such as HMIs, historians, engineering workstations, jump boxes, and supporting services. The stem’s key constraints are deterministic PLC timing, an independent SIS, a short change window, and process continuity. Keeping control and safety functions on their approved physical platforms avoids introducing timing, certification, and failure-mode risks. A hypervisor cluster in the OT environment can reduce workstation hardware while still allowing snapshots, backups, controlled virtual switching, and pre-change testing. The virtual switch should preserve OT segmentation rather than collapse boundaries into enterprise IT. Virtual PLCs and containers can be useful in labs, simulation, training, and some edge use cases, but they are not the safest default for replacing active control or safety functions here.

• Containerized control fails because PLC scan timing and I/O behavior should not be moved to shared container hosts without a validated control design.
• Virtual SIS replacement fails because safety functions require strict independence, certification, and management of change beyond a short maintenance window.
• Enterprise bridge fails because virtual switching should enforce segmentation, not directly expose OT workloads to the user network.

Question 83

Topic: OT Security Operations

A vulnerability affects the HMI software for a batch mixing line. The vendor patch is applicable, but engineering says the update could change the operator interface behavior and interrupt production. A short maintenance window is available tonight. What is the best remediation implementation choice?

Options:

• A. Install the patch immediately during the window

• B. Run active vulnerability scans after patching

• C. Defer all action until the next annual outage

• D. Implement after confirming a tested rollback plan

Best answer: D

Explanation: Rollback plan availability is a key remediation constraint in OT environments. When a patch could disrupt operations, change the operator view, or affect process continuity, the implementation decision must include a known way to return to the prior safe state. That usually means verified backups, documented restoration steps, responsible stakeholders, and success criteria before the maintenance window begins. The available window alone is not enough if recovery steps are uncertain.

A compensating control may be appropriate if rollback is not ready, but simply deferring all action ignores the known exposure. Post-change validation is useful, but it does not replace pre-change rollback readiness.

• Immediate patching misses the operational disruption risk and assumes the maintenance window is sufficient by itself.
• Annual deferral may leave an exploitable HMI vulnerability exposed without considering interim controls or a nearer safe implementation.
• Post-patch scanning supports validation, but it does not address how to recover if the update disrupts the line.

Question 84

Topic: OT Threat Intelligence

A packaging plant receives a passive OT monitoring alert during production. The affected legacy PLC controls a conveyor interlock, active scanning is prohibited, and operations cannot stop the line until tonight’s maintenance window.

Exhibit: Passive evidence

HMI 10.20.5.14 -> PLC 10.20.5.40: normal polling
ARP replies for 10.20.5.40 alternate between two MAC addresses
New MAC source appears on an unused contractor switch port
No approved network change or maintenance ticket exists

Which professional decision is BEST?

Options:

• A. Treat it as normal redundancy and suppress duplicate-address alerts.

• B. Treat it as confirmed vulnerability exploitation and reflash the PLC immediately.

• C. Treat it as a likely unauthorized on-path device and coordinate safe containment.

• D. Treat it as a PLC misconfiguration and wait for the maintenance window.

Best answer: C

Explanation: The evidence most strongly fits an unauthorized device creating an on-path condition. Alternating ARP replies for the PLC IP suggest traffic may be redirected or intercepted, and the new MAC address on an unused contractor port has no approved change record. Because the PLC supports an active production interlock and active scanning is prohibited, the right response is not disruptive device testing or immediate PLC changes. A safety-aware decision would coordinate with operations to contain the suspect port, preserve passive evidence, and avoid interrupting the process unexpectedly.

The key takeaway is to classify the threat pattern from the evidence, then choose containment that respects OT ownership and process continuity.

• Misconfiguration assumption fails because the unapproved contractor-port MAC and alternating ARP replies indicate a stronger unauthorized/on-path pattern.
• Immediate reflashing fails because vulnerability exploitation is not confirmed and changing PLC firmware during production could create unsafe impact.
• Suppressing alerts fails because duplicate identity evidence on an OT control path is not normal redundancy without an approved design or change record.

Question 85

Topic: OT Risk Management

A quarterly risk review is evaluating whether existing risk dispositions are still valid for a packaging line control network. Which interpretation is best supported by the exhibit?

Exhibit: Risk register review note

Options:

• A. Change disposition from accept to mitigate or escalate

• B. Avoid the risk by immediately shutting down Cell 4

• C. Keep acceptance because the asset did not change

• D. Transfer the risk because vendor access exists

Best answer: A

Explanation: Risk disposition is not static. An accepted risk should be revisited when key assumptions change, especially exposure, impact, or operational context. In the exhibit, the same legacy HMI now has a vendor VPN conduit, increasing exposure. Its process impact has changed from rework only to feeding a sterile fill process, increasing consequence. The operating context has also changed to 24/7 production, reducing remediation windows and raising continuity concerns. These changes mean the previous acceptance decision may no longer match the organization’s risk appetite and should be escalated or moved toward mitigation with OT stakeholder coordination.

• Asset unchanged is a trap because risk can change even when the device itself stays the same.
• Vendor access transfer fails because third-party connectivity increases exposure but does not automatically transfer ownership of the risk.
• Immediate shutdown is not supported because avoidance may be disproportionate without an approved safety and operations decision.

Question 86

Topic: OT Threat Intelligence

A chemical facility uses vendor-provided remote I/O modules on a PLC network. The OEM releases a firmware update, but an ISAC advisory warns that the OEM’s update distribution path may have been abused in recent supply-chain activity. The plant must reduce firmware supply-chain risk without disrupting production. Which implementation choice best supports the OT trust objective?

Options:

• A. Install the update during the next maintenance window

• B. Verify signed firmware provenance and test it offline before rollout

• C. Block all future firmware updates from the OEM

• D. Scan the downloaded firmware with endpoint anti-malware only

Best answer: B

Explanation: Supply-chain firmware risk is the risk that trusted vendor components, update channels, or firmware packages introduce compromise into OT assets. In this scenario, the update may still be needed, but the trust path is suspect. A safer implementation is to confirm the firmware came from an authenticated vendor source, validate digital signatures or published hashes, review vendor or ISAC guidance, and test the update in an offline or representative environment before any approved production rollout. This keeps the decision focused on firmware integrity and controlled change, not blind trust in the vendor portal. Simply waiting for a maintenance window does not validate trust, and blocking all updates can create reliability and vulnerability risk.

• Maintenance timing only fails because a valid window does not prove the firmware is authentic or uncompromised.
• Permanent blocking fails because it avoids one supply-chain path but can leave OT devices unsupported or vulnerable.
• Anti-malware only fails because firmware trust requires provenance and integrity checks, not just file scanning.

Question 87

Topic: OT Cybersecurity Architecture, Design, and Engineering

A chemical plant is replacing local accounts on an engineering workstation application that can modify PLC logic. Which access control model best fits the requirements in the exhibit?

Exhibit: Access requirements

Options:

• A. RBAC with static engineering groups

• B. Shared privileged accounts with checkout approval

• C. Mandatory access control with fixed security labels

• D. ABAC with role and context attributes

Best answer: D

Explanation: Attribute-based access control (ABAC) is the best fit when access decisions must evaluate multiple attributes about the subject, resource, action, and environment. In this scenario, the application must consider a user’s role, but role alone is not enough. Write access also depends on an approved change ticket, current shift, network location, managed-device posture, and whether the process is in an active batch run. Those are contextual attributes that can change from one access request to the next.

RBAC is simpler and useful when permissions map cleanly to job functions. Mandatory access control is used when centrally enforced labels and clearances drive access. The key takeaway is that dynamic OT safety and change-control conditions point to ABAC.

• Static role groups fail because engineer membership alone cannot enforce ticket, shift, device, location, and batch-state conditions.
• Fixed labels do not match the requirement to evaluate changing operational context for each write request.
• Shared accounts weaken accountability and conflict with the named individual account requirement.

Question 88

Topic: OT Security Operations

An OT SOC wants to reduce manual work for repeatable portable-media alerts without affecting production control. Which SOAR workflow is best supported by the exhibit?

Exhibit: Alert pattern and constraints

Source: Removable-media scan kiosk -> SIEM
Trigger: Malware signature detected before plant-floor use
Frequency: 8-12 alerts per month
Current manual steps: capture scan result, identify requester, open ticket, notify OT security
Safety constraint: no automated changes to PLCs, HMIs, or production network paths
Required action: media must remain physically held until an OT security analyst reviews it

Options:

• A. Release the media if the requester is authorized

• B. Create a case, enrich requester details, and notify OT security

• C. Automatically reimage the requester’s engineering workstation

• D. Automatically isolate the connected PLC cell

Best answer: B

Explanation: SOAR is best used for repeatable, well-defined response tasks that can be automated safely, especially evidence collection, enrichment, ticket creation, notification, and routing. In this exhibit, the alert is generated before plant-floor use, and the safety constraint prohibits automated changes to PLCs, HMIs, or production network paths. The required hold also means the system should not automatically clear or release the media. A good SOAR workflow accelerates the consistent administrative and analytical steps while preserving human review for decisions that could affect operations or introduce contaminated media.

• PLC isolation fails because containment that changes production connectivity can affect availability and requires OT approval.
• Automatic reimage fails because the exhibit shows a kiosk detection, not confirmed compromise of the requester’s workstation.
• Media release fails because the exhibit explicitly requires OT security analyst review before release.

Question 89

Topic: OT Risk Management

A municipal water plant is updating its risk register for an unsupported PLC that controls chemical dosing. A vendor firmware update requires a 4-hour outage, but the next approved maintenance window is in 6 weeks. Operations owns process safety and availability; OT security owns firewall controls. Compliance requires documented treatment and residual-risk approval before deferral.

Which risk register update is the BEST professional decision?

Options:

• A. Accept the risk permanently because the SIS can trip the process if dosing becomes unsafe.

• B. Name OT security as risk owner, transfer the risk to the vendor, and defer review until the annual audit.

• C. Name Operations as risk owner, document controls, mitigate until the maintenance window, and record residual-risk approval.

• D. Apply the firmware immediately because the vulnerable PLC supports a safety-critical process.

Best answer: C

Explanation: A risk register should connect the risk scenario to accountable ownership, current and planned controls, the selected treatment decision, and residual-risk approval. In this case, Operations owns the process safety and availability impact, while OT security owns a supporting control. Because the firmware update requires downtime and an approved window is 6 weeks away, the safer decision is not an emergency change by default. The register should show mitigation using existing and temporary controls, the planned firmware update, and documented residual-risk approval for the deferral. This preserves process continuity while keeping the risk visible and governed.

• Vendor transfer fails because a vendor may support remediation, but operational risk ownership remains with the organization.
• Permanent acceptance fails because the SIS reduces consequence but does not eliminate the vulnerable PLC risk or the planned treatment need.
• Immediate firmware fails because bypassing change approval and outage planning can create unsafe process disruption.

Question 90

Topic: OT Incident Management

An OT team is investigating a short loss of view from an OPC gateway that feeds the HMI. No process upset occurred. The team must choose the next incident handling action based on host evidence.

Exhibit: Host log excerpts

10:14:22 security: accepted login for svc_remote from jumpbox-02
10:14:48 sudo: svc_remote : COMMAND=/bin/systemctl stop opc-gateway
10:14:49 systemd: opc-gateway.service: Deactivated successfully
10:15:03 app: upstream session closed; no application exception recorded
10:15:06 operator log: HMI tags stale; loss-of-view alarm

Options:

• A. Replace the gateway network switch

• B. Reimage the OPC gateway immediately

• C. Tune the HMI stale-tag alarm threshold

• D. Suspend svc_remote and verify change approval

Best answer: D

Explanation: The host evidence points to an intentional or unauthorized administrative action, not a network fault or normal application crash. The security log shows svc_remote logging in from a jump box, the sudo log shows that account running systemctl stop opc-gateway, and the systemd log confirms the service was deactivated successfully. The application log then reports a closed upstream session, which is consistent with the service being stopped. In an OT incident, the next action should contain the potentially misused account and verify whether there was an approved change before restoring or modifying the service with operations. The key is to correlate host logs by time and source before choosing a disruptive recovery step.

• Network replacement is not supported because the host logs show a local service stop, not switch failure evidence.
• Immediate reimage is too disruptive without evidence of malware or system compromise requiring eradication.
• Alarm tuning treats the symptom, but the logs identify an administrative action that caused the loss of view.

Continue with full practice

Use the CompTIA SecOT+ SOT-001 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Try CompTIA SecOT+ SOT-001 on Web View CompTIA SecOT+ SOT-001 Practice Test

Focused topic pages

• OT Systems and Safety Foundations
• OT Risk Management
• OT Threat Intelligence
• OT Security Architecture
• OT Security Operations
• OT Incident Management

Free review resource

Use the full IT Mastery practice page above for the latest review links and practice page.