CyberCertPrepOT Security FundamentalsOT Fundamentals: Network Architecture & ProtocolsMEDIUMFree question
Monitoring shows a Modbus write to a holding register storing a pressure setpoint, sent from an engineering laptop at 02:00 with no change ticket open. Which is the BEST first response?
- A.Block the laptop MAC at the core switch before talking to anyone
- B.Confirm with the shift lead whether the change was authorized
- C.Reset the PLC to factory defaults to clear the setpoint
- D.Power off the pump skid to stop the new setpoint acting
Why B is correct
In OT the first step is to verify intent with operations, because the write may be legitimate and abrupt actions such as resets or shutdowns can cause a process upset. Escalation follows if no one authorized it.
Know someone studying for OT Security Fundamentals? Send them this one.