CyberCertPrepOT Security FundamentalsOT Fundamentals: Securing Industrial Control SystemsMEDIUMFree question
A passive sensor reports a host at 10.20.4.17 exchanging S7comm with three PLCs, yet the inventory spreadsheet has no such entry. What is the best response?
- A.Block its subnet at the firewall before contacting anyone
- B.Mark it unknown then confirm ownership with operations
- C.Assume the sensor mislabeled a known HMI then close the alert
- D.Add it to the inventory automatically with a trusted status
Why B is correct
An unexplained device talking a control protocol to PLCs is an unrecorded asset until someone proves otherwise, so ownership is verified with the people who run the process. Auto-trusting or dismissing it hides a possible rogue laptop, and blocking blind risks cutting a legitimate link to live controllers.
Know someone studying for OT Security Fundamentals? Send them this one.