CompTIA SecOT+ SOT-001: OT Systems and Safety Foundations

Topic snapshot

Sample questions

These original IT Mastery practice questions are aligned to this topic area. Use them for self-assessment, scope review, and deciding what to drill next.

Question 1

Topic: OT Systems and Safety Foundations

A batch reactor uses PLC logic to open a cooling-water valve when jacket temperature rises above the operator set point. Operators need an HMI trend that shows what input caused the action, what output the PLC commanded, and whether the process state changed. Which tag set is the best implementation choice?

Options:

• A. Valve-open command, valve-close command, and PLC scan time

• B. Valve position feedback, flow totalizer, and historian archive status

• C. Temperature set point, recipe ID, and operator login status

• D. Temperature PV, temperature set point, valve-open command, and valve position feedback

Best answer: D

Explanation: Control-system action is interpreted by relating inputs, control logic references, outputs, and feedback. In this case, the jacket temperature process variable is the input that drives the decision, and the set point is the reference used by the PLC logic. The valve-open command is the PLC output. Valve position feedback, or a closely related flow feedback input, helps confirm that the commanded output actually changed the physical process state. A trend with only commands or only historical context cannot show the full cause-and-effect path from process condition to control action to resulting state.

• Output-only view misses the process variable and set point, so it cannot explain why the PLC commanded the valve.
• Context-only tags such as recipe and login data may support auditing but do not show I/O behavior for this control action.
• Feedback-only view can show the result but not the input condition or PLC output that caused it.

Question 2

Topic: OT Systems and Safety Foundations

During a planned maintenance window, a cybersecurity engineer must install a temporary packet-capture sensor inside a motor control center cabinet for a packaging line. The line can be stopped for 30 minutes, and site rules require operations authorization for cabinet work. Which control sequence best prevents the cyber task from creating unacceptable physical or process risk?

Options:

• A. Coordinate with operations, complete a JSA, stop and LOTO affected equipment, use required PPE, install the sensor, then restore through operations acceptance and outbrief

• B. Have the vendor perform the installation remotely, document the change, and validate process quality at the next shift handoff

• C. Run passive discovery first, install the sensor if no alarms occur, then complete the JSA and LOTO steps after the change

• D. Open an IT change ticket, wear arc-rated PPE, install the sensor while the line runs, then notify operations after traffic is visible

Best answer: A

Explanation: Safety control sequencing in OT places process ownership and hazard controls ahead of cybersecurity work. Operations must authorize the process state because the work affects production equipment, not just network visibility. A JSA or pre-job briefing identifies electrical, mechanical, and process hazards before the cabinet is opened. LOTO and verification of the affected equipment control hazardous energy when the line can be safely stopped. PPE is still required, but it is not a substitute for authorization, hazard analysis, or energy isolation. Restoration should also be controlled: remove LOTO only through the approved procedure, confirm the process is safe, and close with an outbrief or operations acceptance. The key takeaway is to control physical risk before performing the cyber task, then return the process to service deliberately.

• PPE-only thinking fails because arc-rated PPE does not replace operations authorization, JSA, or LOTO for cabinet work.
• Safety after change fails because hazard analysis and energy control must occur before opening or modifying affected equipment.
• Remote vendor work fails because remote assistance does not satisfy local cabinet safety controls or process restoration requirements.

Question 3

Topic: OT Systems and Safety Foundations

A plant SOC receives repeated failed-login alerts against an engineering workstation used to maintain the safety instrumented system (SIS) for a running chemical unit. The unit is stable, but the SIS provides automated protective shutdown for overpressure events. Operations reports no process abnormality, and the next approved maintenance window is in 18 hours. What is the BEST professional decision?

Options:

• A. Treat it like a standard IT workstation alert

• B. Escalate as safety-critical and coordinate supervised access

• C. Disable the workstation network port immediately

• D. Allow remote vendor login to troubleshoot now

Best answer: B

Explanation: Device role changes the security response in OT. An SIS supports protective functions, so failed-login activity against its engineering workstation deserves higher priority than a routine endpoint alert. However, the unit is stable and there is an approved maintenance window soon, so the response should preserve safety and process continuity: escalate, restrict and supervise any access, involve operations/process safety, and coordinate changes through the approved maintenance process. Immediate isolation or unsupervised vendor access could create operational risk or bypass ownership controls.

The key takeaway is that safety-critical control-system roles increase urgency, but they do not justify uncontrolled changes to live OT systems.

• Standard IT handling fails because the SIS maintenance role makes the asset safety-critical, not just another endpoint.
• Immediate port disablement may be unsafe because it changes connectivity to a safety-related support asset without operations coordination.
• Unsupervised vendor access fails because emergency troubleshooting is not justified by stable process conditions and weakens access control.

Question 4

Topic: OT Systems and Safety Foundations

A water treatment facility is updating its OT asset inventory before applying new access controls. Two Windows hosts are in the control room. Host 1 runs vendor PLC programming software, stores controller project files, and is used only during approved maintenance windows to upload/download logic. Host 2 displays process values, alarms, and trends, and operators use it 24/7 to acknowledge alarms and adjust pump set points. Which classification and control decision is BEST?

Options:

• A. Classify both hosts as engineering workstations

• B. Classify Host 1 as an engineering workstation and Host 2 as an operator workstation

• C. Classify both hosts as operator workstations

• D. Classify Host 1 as a historian and Host 2 as an engineering workstation

Best answer: B

Explanation: Engineering workstations and operator workstations interact with control systems differently. An engineering workstation is used to configure, program, upload, download, and maintain controller logic or device configuration, so access should be tightly controlled and aligned with approved change windows. An operator workstation, often an HMI, supports day-to-day process visibility and control, such as viewing alarms, trends, process values, and issuing approved operational commands. In this scenario, Host 1 has the tools and files needed to alter PLC logic, while Host 2 is used continuously by operators to run the process safely. Confusing the roles can lead to poor access control, excessive privileges, or avoidable operational risk.

• Classifying both as operator workstations misses the programming and logic-download function on Host 1.
• Classifying both as engineering workstations overstates Host 2 privileges and could disrupt 24/7 operations.
• Calling Host 1 a historian confuses configuration activity with long-term process data collection.

Question 5

Topic: OT Systems and Safety Foundations

A control engineer is reviewing a tank-level control loop after operators report overshoot during startup. The PLC receives a level transmitter value, compares it to the operator-entered target level, and adjusts a VFD-driven pump. For the HMI trend, which configuration best identifies the process variable and set point?

Options:

• A. PV: measured tank level; SP: target tank level

• B. PV: pump speed command; SP: measured tank level

• C. PV: target tank level; SP: transmitter calibration range

• D. PV: high-level alarm limit; SP: pump speed command

Best answer: A

Explanation: In a feedback control loop, the process variable (PV) is the current measured value of the controlled process condition. Here, the level transmitter reports the actual tank level, so that tag is the PV. The set point (SP) is the desired value the controller tries to maintain, which is the operator-entered target tank level. The controller compares PV to SP and changes the output, such as pump speed, to reduce the error.

The key distinction is measurement versus desired target; controller output and alarm limits are related loop data but are not the PV or SP.

• Pump speed as PV confuses controller output with the measured process condition being controlled.
• Alarm limit as PV confuses a protection or notification threshold with the live process measurement.
• Calibration range as SP describes instrument scaling, not the desired operating target for the loop.

Question 6

Topic: OT Systems and Safety Foundations

A controls engineer must replace an Ethernet communication module in a conveyor control cabinet. The line is currently stopped from the HMI, but maintenance will require opening the cabinet and removing the module.

Exhibit: Work planning note

What is the best next action before the engineer starts work?

Options:

• A. Disable the SCADA user account

• B. Perform LOTO and verify zero energy state

• C. Wear arc-rated PPE and proceed

• D. Keep the HMI in stop mode

Best answer: B

Explanation: Lockout/tagout is required when maintenance could expose personnel to hazardous energy or unexpected process movement. In this scenario, stopping the line from the HMI is not enough because the exhibit shows multiple energy sources: upstream electrical power, a VFD that can be commanded remotely, stored pneumatic pressure, gravity movement from a raised gate, and an auto-restart condition. A safe approach is to follow the site LOTO procedure, isolate each applicable energy source, release or restrain stored energy, apply locks and tags, and verify a zero energy state before touching the equipment. PPE can reduce injury severity, but it does not replace energy isolation.

• HMI stop only fails because control commands are not physical energy isolation and auto-restart is enabled.
• PPE only fails because protective clothing does not control stored pneumatic pressure, gravity movement, or remote starts.
• Account disabling fails because user access control does not isolate electrical or mechanical energy sources.

Question 7

Topic: OT Systems and Safety Foundations

A maintenance team plans to add an Ethernet media converter for a remote I/O cabinet in a solvent blending area. The safety briefing says production cannot start until installed equipment is suitable for the area.

Exhibit: Work order excerpt

What is the best interpretation of this exhibit?

Options:

• A. The proposed device is not appropriate for the environment.

• B. The device is acceptable if connected through a firewall.

• C. The device is acceptable if documented in the asset inventory.

• D. The device is acceptable if installed during a shutdown.

Best answer: A

Explanation: Industrial ratings affect whether equipment can be safely used in a specific physical environment. Here, the decisive facts are the solvent blending area, possible flammable vapors, washdown cleaning, and the explicit requirement for hazardous-location and washdown-suitable equipment. An office-grade IP20 device with no hazardous-location marking does not meet those environmental requirements, regardless of its network function. The issue is not whether Ethernet is needed; it is whether the physical device and enclosure are rated for the hazards where it will be installed.

Scheduling, documentation, or cybersecurity controls do not make unrated equipment suitable for a hazardous or wet industrial area.

• Shutdown timing does not change the required equipment rating for the installed environment.
• Firewall protection may reduce network risk, but it does not address flammable vapor or washdown suitability.
• Asset inventory improves tracking, but it does not make an office-grade device physically safe for the area.

Question 8

Topic: OT Systems and Safety Foundations

A packaging line PLC intermittently places a VFD in safe stop even though no operator stop command is recorded. Review the event excerpt and identify the most likely issue.

Exhibit: PLC event excerpt

Watchdog preset: 2,000 ms for remote I/O heartbeat
Start-delay TON preset: 10 s

08:14:01.000  Remote I/O heartbeat received
08:14:01.500  Remote I/O heartbeat received
08:14:04.200  Watchdog expired; outputs de-energized
08:14:04.230  VFD Safe Stop asserted
08:14:05.000  Remote I/O heartbeat received
08:14:11.000  Start-delay TON done

Options:

• A. Remote I/O heartbeat loss triggered the watchdog

• B. An operator changed the speed set point

• C. The VFD completed a normal timed start

• D. The start-delay timer stopped the VFD

Best answer: A

Explanation: A watchdog detects missing or late activity, such as a remote I/O heartbeat, and forces a defined fault response when timing expectations are not met. In the excerpt, the last heartbeat before the fault was at 08:14:01.500, and the watchdog expired at 08:14:04.200, a gap of about 2.7 seconds. That exceeds the 2,000 ms watchdog preset, so de-energizing outputs and asserting safe stop are consistent with watchdog fault detection. The TON start-delay timer is a normal process timer, but it completes later and does not explain the stop event.

• Timer confusion fails because the TON completion occurs after safe stop and is not the logged cause of output de-energization.
• Set point change is unsupported because the excerpt shows no speed command or tag write.
• Normal start is unsupported because the log records a watchdog expiration and safe stop, not a successful start sequence.

Question 9

Topic: OT Systems and Safety Foundations

A port authority is building an OT asset inventory before deploying passive wireless monitoring. Operations will not allow active probing during vessel movements, and the inventory must correctly classify each wireless context for safety and continuity planning. Which classification is the BEST professional decision?

Options:

• A. VHF: Wi-Fi; AIS: metering; VSAT: sensor mesh; M-Bus: satellite backhaul; 802.15.4: marine voice; 802.11: vessel tracking

• B. VHF: sensor mesh; AIS: marine voice; VSAT: metering; M-Bus: vessel tracking; 802.15.4: Wi-Fi; 802.11: satellite backhaul

• C. VHF: marine voice; AIS: vessel tracking; VSAT: satellite backhaul; M-Bus: metering; 802.15.4: sensor mesh; 802.11: Wi-Fi

• D. VHF: metering; AIS: satellite backhaul; VSAT: Wi-Fi; M-Bus: marine voice; 802.15.4: vessel tracking; 802.11: sensor mesh

Best answer: C

Explanation: Wireless OT communication contexts often reflect the operating environment. In a maritime or port OT setting, VHF is commonly associated with marine radio communications, while AIS supports vessel identification and tracking. VSAT provides satellite connectivity for remote or mobile assets. M-Bus is used in metering contexts, including wireless meter reading variants. IEEE 802.15.4 commonly supports low-power wireless sensor or field networks, while IEEE 802.11 is Wi-Fi. For a safety-sensitive inventory, the best decision is accurate passive classification before monitoring or controls are changed.

• Swapped protocol roles fails because Wi-Fi, AIS, and VSAT have distinct communication contexts that should not be interchanged.
• Metering confusion fails because M-Bus is the metering-related context, not VHF or marine voice systems.
• Wireless standard mismatch fails because 802.15.4 is associated with low-power sensor networks, while 802.11 is Wi-Fi.

Question 10

Topic: OT Systems and Safety Foundations

An IT security analyst proposes to immediately quarantine an OT workstation after an EDR alert, stating that it is “only a Windows endpoint, not a controller.” Plant operations are in an active production run.

Exhibit: Asset record

Which interpretation best evaluates the proposed decision?

Options:

• A. It is flawed because the HMI directly performs pressure trips.

• B. It is appropriate because Windows assets are IT-owned endpoints.

• C. It is flawed because HMI loss can create loss of view/control.

• D. It is appropriate because PLC-7 will continue running logic.

Best answer: C

Explanation: OT security decisions must account for device function and operational consequence, not just operating system or endpoint category. The exhibit shows that TANK-HMI-02 is an operator interface for alarms, tank levels, and setpoint changes. Quarantining it may not stop PLC-7 or disable the SIS, but it can cause loss of view and local control during an active run. A safer containment decision would involve OT operations, verify alternate monitoring/control paths, and choose a response that reduces cyber risk without creating a process safety issue. The key point is that “not a controller” does not mean “no operational impact.”

• PLC continues is tempting, but continued logic execution does not address operator loss of view/control.
• Pressure trips overstates the HMI role because the exhibit says the SIS trips independently.
• IT-owned endpoint ignores OT function; ownership or operating system does not determine operational consequence.

Continue with full practice

Use the CompTIA SecOT+ SOT-001 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Try CompTIA SecOT+ SOT-001 on Web View CompTIA SecOT+ SOT-001 Practice Test

Related focused pages

• Free CompTIA SecOT+ SOT-001 Full-Length Practice Exam
• OT Risk Management
• OT Threat Intelligence
• OT Security Architecture
• OT Security Operations
• OT Incident Management

Free review resource

Use the full IT Mastery practice page above for the latest review links and practice page.