CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsMEDIUMFree question
A water district maps its OT plan to NIST SP 800-61. Which task is best placed in the containment step rather than eradication?
- A.Blocking the attacker access path at the DMZ firewall
- B.Resetting the vendor passwords at the plant
- C.Patching the SCADA server application stack
- D.Rebuilding the jump host from a clean image
Why A is correct
Cutting the communication path limits damage quickly and is a containment move that does not require changing the compromised systems. Rebuilds, password resets and patches remove root causes and belong to eradication.
Know someone studying for OT Security Fundamentals? Send them this one.