A vendor documents a supported query tool for its controllers. How should the team introduce active discovery with it?
- A.Run it at full rate during production to measure impact
- B.Enable it permanently on the sensor with default settings
- C.Point it at Level 4 servers instead of controllers
- D.Prove it on a staging spare then use it in a window
Why D is correct
Even a vendor tool can behave differently across firmware versions, so it is proven on a spare or lab unit first and then used under operations approval with rate limits. Defaults at full rate or a wrong target give no safe evidence.
Know someone studying for OT Security Fundamentals? Send them this one.