Free CompTIA SecOT+ Practice Questions

Q1.A post-incident review concludes that the root cause was a phishing email. What is wrong with stopping there?

• A.Phishing is the first cause, not the root cause, which lies in conditions such as remote access without multi-factor authentication and a flat path to level 2
• B.Phishing cannot be a root cause because the message was delivered by the enterprise environment rather than by anything inside the plant network itself
• C.The review should name the specific malware family involved before any cause is recorded as final
• D.A root cause must always name a failed technical control rather than a human action by staff

Domain: OT Incident Management

Q2.What does eradication mean in an OT environment, as distinct from removing malicious files?

• A.Closing the access path, rebuilding systems that can write to controllers and rotating exposed credentials
• B.Deleting the malicious files identified by antivirus from every Windows machine in the affected zone
• C.Replacing all affected controllers with new hardware so no compromised device remains in service
• D.Blocking the attacker's command and control addresses at the enterprise internet gateway

Domain: OT Incident Management

Q3.When verifying setpoints and alarm limits before restart, what should they be checked against?

• A.The design documentation, because the values in the controller may be the ones that were altered
• B.The values recorded in the controller immediately before the incident was declared
• C.The historian trend for the same production campaign in the preceding month
• D.The operator's recollection of normal running values for that unit under steady conditions

Domain: OT Incident Management

Q4.On a plant site, who holds the authority to veto a proposed change on safety grounds?

• A.The process safety engineer
• B.The chief information security officer, because the security policy applies to every system the organisation owns
• C.The controls engineer who maintains the instrument loops and the controller programs for the affected unit
• D.The lead operator on shift at the time the change is proposed for the affected process area

Domain: OT Systems and Safety Foundations

Q5.What defines a properly functioning industrial DMZ?

• A.Neither side initiates a session straight through; the plant initiates into it and the enterprise initiates into it
• B.Every session that crosses it is encrypted end to end and authenticated with multi-factor credentials issued by the enterprise identity provider
• C.It is placed on a separate physical switch stack with its own address range and its own set of firewall management credentials
• D.Traffic crossing it is inspected by an intrusion detection sensor and every allowed flow is recorded in the site log archive

Domain: OT Systems and Safety Foundations

Q6.Which statement best describes operational technology?

• A.Hardware and software that monitors and controls physical equipment and physical processes such as pumps, valves, motors and breakers
• B.Hardware and software that stores, processes and transmits business records, transactions and correspondence for an organisation
• C.A category of networking equipment purpose built to carry encrypted traffic between geographically separated corporate data centres
• D.The collection of regulatory frameworks that govern how critical infrastructure operators report cyber incidents to a national authority

Domain: OT Systems and Safety Foundations

Q7.What is the correct order of security priorities on a plant floor, from highest to lowest?

• A.Safety, availability, integrity, confidentiality
• B.Confidentiality, integrity, availability, followed by safety as a separate engineering concern
• C.Availability, safety, confidentiality, integrity, because production uptime funds every other control
• D.Integrity, safety, availability, confidentiality, because bad data causes every physical failure

Domain: OT Systems and Safety Foundations

Q8.An analyst finds an unpatched remote code execution flaw on an operator station displaying a running exothermic reaction. Company policy for corporate servers is immediate network isolation. What should the analyst do?

• A.Keep the station in service, apply compensating controls at the network boundary, and schedule remediation through the plant change process
• B.Isolate the operator station from the network immediately in line with the corporate incident response policy for unpatched hosts
• C.Disconnect the station and instruct the operator to monitor the reaction from the engineering workstation in the site server room instead
• D.Install the vendor patch during the current shift and reboot the station once the operator confirms the reaction is stable

Domain: OT Systems and Safety Foundations

Q9.A programmable logic controller has been in continuous service since 2004 and runs an operating system that lost vendor support years ago. How should this be characterised?

• A.A normal operational technology condition, managed with compensating controls until a planned outage allows replacement
• B.Evidence of negligence by the plant engineering team that should be escalated to the audit committee as a governance failure
• C.A finding requiring the controller to be replaced within the current quarter regardless of the production schedule and vendor validation
• D.A licensing violation, because operating systems past vendor support may not lawfully be used in an industrial setting

Domain: OT Systems and Safety Foundations

Q10.When restoring controller logic after an incident, where should the logic come from?

• A.The verified golden copy held in the backup repository rather than the running controller
• B.An upload taken from the running controller just before the restore, so current tuning is preserved
• C.The most recent project file found on the engineering workstation that manages that controller
• D.The vendor's default template for that controller family, reconfigured to match the process

Domain: OT Incident Management