Free CompTIA SecOT+ Practice Questions

Q1.Substation breakers open one after another. The traffic carrying the trip commands is correctly formatted for the protocol in use, but it originates from a host that has never sent control commands before. Which technique is this?

• A.Unauthorised command message
• B.Denial of service
• C.Spoof reporting message, because the control centre received data indicating the breakers were in a state they were not in
• D.Modify parameter, since opening a breaker changes the operating configuration of the substation feeder

Domain: OT Threat Intelligence

Q2.During recovery from an OT intrusion, what must the team confirm before rebuilding or restoring anything?

• A.That containment holds and the attacker's path into the environment is closed
• B.That the historian retention window still covers the whole period of the intrusion
• C.That the regulator has acknowledged the notification submitted at the start of the incident
• D.That antivirus signatures on all level 2 machines have been updated to the current release

Domain: OT Incident Management

Q3.Why is a shared vendor account a problem even when the password is strong and changed regularly?

• A.It proves a company connected but not which individual did
• B.It cannot be protected with multifactor authentication because the second factor is bound to one device
• C.It cannot be disabled quickly because several vendor engineers would lose access at the same time
• D.It usually holds engineering rights on the controller rather than read-only rights on the historian

Domain: OT Risk Management

Q4.An advisory affects a protocol feature that the site's controllers support but have never had enabled. How does this affect the assessment?

• A.It lowers the priority, but the finding is recorded and revisited if a future change enables the feature
• B.It has no effect, because the vulnerable code is present in the firmware image whether or not the function is configured for use on site
• C.It removes the finding from the register permanently
• D.It raises the priority, because unused features receive less scrutiny during operation

Domain: OT Security Operations

Q5.Two advisories arrive. Advisory A scores 9.8 and affects a controller behind a one-way gateway inside a zone that four people can reach. Advisory B scores 5.3 and affects a device on a conduit carrying traffic to a safety instrumented system. How should the site prioritise?

• A.Advisory B first, because it is reachable from an adjacent zone and the consequence is loss of a safety function
• B.Advisory A first, because a base score above nine indicates a flaw that is trivially exploitable and must always be treated as the more urgent of the two
• C.Both at equal priority, since neither has a vendor validated patch yet
• D.Neither, until the vendor publishes an updated temporal score

Domain: OT Security Operations

Q6.Loss of view, loss of control, loss of safety, loss of availability and damage to property are examples of which ATT&CK for ICS tactic?

• A.Impact
• B.Impair Process Control
• C.Inhibit Response Function, which the matrix uses for every outcome that reduces the operator's ability to run the plant
• D.Collection, because each of those outcomes has to be observed and recorded before it can be classified

Domain: OT Threat Intelligence

Q7.Which assets sit at Purdue level 0?

• A.Pressure transmitters, control valves and variable frequency drives
• B.Programmable logic controllers, remote terminal units and distributed control system controllers running the plant logic
• C.Human-machine interfaces, alarm servers and the engineering workstation used for that production area
• D.The plant historian, the manufacturing execution system and the operational technology patch distribution server

Domain: OT Systems and Safety Foundations

Q8.A vendor brochure states that the safety instrumented system is independent of the process control system. Which three checks actually verify that separation?

• A.Whether a network path exists, whether one engineering workstation can program both, and whether the same removable media is used on both
• B.Whether the safety logic solver carries a valid certification mark, whether proof testing is current, and whether the vendor holds a maintenance contract for the installed firmware revision
• C.Whether the SIS has redundant power, whether it is on a separate uninterruptible supply, and whether its cabinets are locked
• D.Whether the safety integrity level was derived from a LOPA study and signed off by the process safety engineer

Domain: OT Cybersecurity Architecture, Design, and Engineering

Q9.What does IEC 62443-3-3 provide?

• A.System security requirements, each tied to a security level, for the control system as a whole
• B.The technical security requirements that an individual component such as a controller or a network switch has to satisfy before purchase
• C.The process for partitioning an industrial automation and control system into zones and conduits and assigning a target security level to each
• D.The security requirements that apply to a service provider carrying out integration, commissioning or maintenance work on an operating site

Domain: OT Risk Management

Q10.What is the residual risk statement in a documented acceptance?

• A.A plain language description of what could still happen with the acceptance in force
• B.A numerical score recalculated by the assessment tool after the controls are added
• C.A list of every control considered and rejected on cost grounds
• D.The date by which the primary control will be installed

Domain: OT Risk Management