CyberCertPrepOT Security FundamentalsOT Fundamentals: Securing Industrial Control SystemsEASYFree question
An OT team is hardening newly delivered HMIs that ship with a built-in web server enabled on port 80. The HMIs are only ever operated locally at the panel. What is the most appropriate action?
- A.Leave the web server running but block port 80 only at the perimeter firewall
- B.Disable the embedded web server because it is an unused service that expands the attack surface without any operational need
- C.Replace HTTP with HTTPS on the same web server and keep it enabled
- D.Enable the web server on every HMI for consistency, then audit access logs monthly
Why B is correct
Least-functionality hardening means disabling services that serve no operational purpose. If the HMI is used only locally, its embedded web server should be turned off entirely rather than merely firewalled, removing the service as an attack vector.
Know someone studying for OT Security Fundamentals? Send them this one.