CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
An operator reports that a pump started without a command from the HMI. Which detection source does this report represent?
- A.Operator observation
- B.A SIEM correlation rule hit
- C.A historian compression report
- D.An IDS alert on the DMZ firewall
Why A is correct
Operators know how the process normally behaves and are often first to notice odd actions, so their reports are a primary OT detection source. The other items do not observe process behavior.
Know someone studying for OT Security Fundamentals? Send them this one.