CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsMEDIUMFree question
A packaging plant plan lets IT staff isolate any infected host at once. A PLC engineering laptop is infected while attached to a running line. Which plan change is best justified?
- A.Require a signed forensic image before any isolation
- B.Delay isolation until the next quarterly patch window
- C.Require operations sign-off before isolating hosts on live control
- D.Give isolation authority to the SOC lead for the live line
Why C is correct
A laptop attached to a running line may be sending commands that the process depends on, so cutting it off blind can cause a trip. Operations sign-off protects safety. A forensic image or patch window adds delay with no safety benefit.
Know someone studying for OT Security Fundamentals? Send them this one.