Cisco 810-115: Cisco OT Security (OTSEC)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1OT monitoring and incident response

   Which TWO are valid benefits of passive OT asset discovery? (Choose two.)

   1. AIt requires stopping production to collect data
   2. BIt identifies devices without sending probes that could disrupt control traffic
   3. CIt builds an inventory from observed communications over time
   4. DIt replaces the need for segmentation
   5. EIt sends commands to each device to confirm its status
   Show answer and explanationHide answer

   Correct answer: B, C

   Passive discovery builds inventories without probes and from observed traffic. It does not require downtime, replace segmentation, or send commands to devices.

2. Question 2OT threats and risk

   A security team assesses a water utility and identifies that a single compromised engineering workstation could change PLC logic. What term describes this risk?

   1. ARegulatory compliance checklist line item
   2. BAttack path to safety-relevant control logic
   3. CRoutine scheduled maintenance window for patching
   4. DVendor asset warranty status and support contract expiry
   Show answer and explanationHide answer

   Correct answer: B

   A path from a workstation to control logic is an attack path with safety implications. Maintenance windows, checklists and warranties describe other concepts.

3. Question 3OT architecture and protocols

   A plant engineer asks how the Purdue model organizes an industrial network. Which description is most accurate?

   1. AA flat network in which each device can communicate freely with each other device, with no separation between control and business layers
   2. BA model that is limited to describing wireless access points and their radio channel assignment tables in a plant's coverage area
   3. CA layered model from field devices at the bottom up to enterprise systems at the top, with segmentation between levels
   4. DA model limited to describing cloud-hosted SaaS applications and public internet services used by the enterprise in a hybrid deployment
   Show answer and explanationHide answer

   Correct answer: C

   The Purdue model layers OT from field devices (Level 0 to 1) up to supervisory and enterprise systems, with segmentation between levels. It is not flat, cloud-only, or wireless-only.

4. Question 4OT network segmentation and defence

   An OT network design places a firewall between the enterprise zone and the industrial DMZ. Which rule type is most appropriate at this boundary?

   1. AAllow traffic based on source port only, which keeps the rule set short
   2. BAllow all traffic from the enterprise to the OT zone for operator convenience
   3. CAllow all traffic because both zones belong to the same company and share one IT policy
   4. DAllow only specific, necessary flows between zones and deny all others by default
   Show answer and explanationHide answer

   Correct answer: D

   Default-deny with explicit allowed flows is the recommended boundary policy. Allow-all rules and port-only rules weaken segmentation.

5. Question 5OT monitoring and incident response

   A security operations centre wants to detect unexpected changes to PLC logic. Which capability provides this?

   1. AConfiguration and logic change monitoring with baselines and alerts
   2. BChecking the PLC's display colour on the operator panel at each shift change
   3. CIgnoring logic changes unless production stops and treating edits as routine
   4. DMonitoring email only for security alerts sent by historian and SCADA servers
   Show answer and explanationHide answer

   Correct answer: A

   Logic change monitoring against baselines detects unauthorized modifications. Email monitoring, colours and waiting for production stoppage do not detect logic changes.