CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question

During a suspected malware event on a plant network, the responder is weighing whether to immediately power off an affected HMI to capture a clean image. The plant is mid-batch on a chemical process. What guiding principle applies?

A.Disconnect every network cable in the cell to guarantee containment
B.Always image the device first because forensic evidence is irreplaceable
C.Preserving safety and continued safe operation takes precedence over evidence preservation
D.Defer all action until the corporate legal team approves the image

Why C is correct

In OT, abruptly removing or powering down a device controlling a live process can create unsafe conditions. The accepted principle is that safety and safe continued operation outrank evidence collection, so responders coordinate with operations before any action that could disrupt the process.

Know someone studying for OT Security Fundamentals? Send them this one.

Where this fits in the OT Security Fundamentals exam

OT Fundamentals: Incident Response & Forensics

Covers incident response plans, forensic tools, evidence collection, and recovery in OT environments.

This question belongs to the "OT Incident Response & Forensics" domain, which makes up about 12% of the OT Security Fundamentals exam.

Practice this topic OT Security Fundamentals exam guide

During a suspected malware event on a plant network, the responder is weighing whether to immediately power off an affected HMI to capture a clean image. The plant is mid-batch on a chemical process. What guiding principle applies?

Where this fits in the OT Security Fundamentals exam

More free OT Fundamentals: Incident Response & Forensics questions

One question down. Thousands to go.