CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
A plant team lists the NIST SP 800-61 phases to build its OT response program. Which activity belongs to the preparation phase?
- A.Reviewing lessons learned with the plant operators
- B.Alerting the regulator after a confirmed intrusion
- C.Rebuilding an infected engineering laptop from an image
- D.Baselining normal traffic plus offline logic backups
Why D is correct
Preparation covers work done before an incident such as baselines, backups, tools, contacts and training. Rebuilding is eradication or recovery, reviewing lessons is post-incident activity and alerting the regulator is part of coordination during the incident.
Know someone studying for OT Security Fundamentals? Send them this one.