CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
Under NIST SP 800-61 an analyst confirms an alert from a passive OT sensor is a real unauthorized write to a PLC. Which phase has the analyst just completed?
- A.Post-incident review phase
- B.Recovery control phase
- C.Detection analysis phase
- D.Preparation toolkit phase
Why C is correct
Validating an alert and scoping what it means is the detection and analysis phase. Preparation happens earlier, recovery follows containment, and post-incident activity is the final review stage.
Know someone studying for OT Security Fundamentals? Send them this one.