CyberCertPrepOT Security FundamentalsOT Fundamentals: Securing Industrial Control SystemsEASYFree question
Which passive-monitoring output best helps find a rogue laptop plugged into the Level 2 network?
- A.A rise in disk usage on the historian server
- B.A changed program checksum on a networked PLC
- C.A shorter scan cycle on one of the networked controllers
- D.A new MAC address appearing in the observed device list
Why D is correct
A previously unseen MAC address is the direct sign that an unknown device joined the segment. The other readings relate to storage, logic changes or controller timing.
Know someone studying for OT Security Fundamentals? Send them this one.