CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
A facility wants to validate that its OT incident response plan works without risking production. Which low-risk activity directly tests decision-making and roles?
- A.Detonating live ransomware on a spare PLC, since evidence collection on live control systems never risks process disruption
- B.Running a tabletop exercise based on a realistic OT scenario
- C.Disconnecting the historian during peak production, which lets the historian reconstruct field-level I/O states it never collected
- D.Disabling the safety instrumented system to see who notices
Why B is correct
A tabletop exercise walks the team through a discussion-based scenario, testing roles, communication paths, and decisions without touching live systems. It is a core preparation activity precisely because it avoids operational risk.
Know someone studying for OT Security Fundamentals? Send them this one.