CertArea
All Cisco exams

Free 810-115 practice test: 30 questions with answers

30 original questions for Cisco OT Security (OTSEC), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
60 min

810-115 exam guide: topics, cost and format

All 30 810-115 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

OT monitoring and incident response (8 questions)

  1. Question 1

    Which TWO are valid benefits of passive OT asset discovery? (Choose two.)

    1. AIt requires stopping production to collect data
    2. BIt identifies devices without sending probes that could disrupt control traffic
    3. CIt builds an inventory from observed communications over time
    4. DIt replaces the need for segmentation
    5. EIt sends commands to each device to confirm its status
    Show answer and explanation
    Correct answer: B, C

    Passive discovery builds inventories without probes and from observed traffic. It does not require downtime, replace segmentation, or send commands to devices.

  2. Question 2

    A security operations centre wants to detect unexpected changes to PLC logic. Which capability provides this?

    1. AConfiguration and logic change monitoring with baselines and alerts
    2. BChecking the PLC's display colour on the operator panel at each shift change
    3. CIgnoring logic changes unless production stops and treating edits as routine
    4. DMonitoring email only for security alerts sent by historian and SCADA servers
    Show answer and explanation
    Correct answer: A

    Logic change monitoring against baselines detects unauthorized modifications. Email monitoring, colours and waiting for production stoppage do not detect logic changes.

  3. Question 3

    An OT security sensor sees traffic from an unknown device communicating with a PLC using a write command. What is the appropriate first response?

    1. AAlert the OT security team and verify the device against the asset inventory before taking action
    2. BImmediately shut down the whole plant to contain the event, without checking the asset inventory first and restart later
    3. CIgnore it because it may be normal, given that scheduled operator writes are common
    4. DPost the event on a public forum so peers across other utilities can comment, including the device address openly
    Show answer and explanation
    Correct answer: A

    Alerting and verifying against inventory is the proportionate first response. Unnecessary shutdowns, ignoring writes and public posting are inappropriate.

  4. Question 4

    A monitoring platform must correlate events from IT firewalls, OT sensors, and identity systems to find attacks that cross zones. Which capability enables this?

    1. ADeleting logs after 24 hours to free disk space on collectors at each OT sensor
    2. BCentralized security analytics with normalized event data across IT and OT
    3. CSeparate unconnected logs for each team in isolated silos with their own consoles
    4. DManual review of printed logs each shift by night staff for compliance audits
    Show answer and explanation
    Correct answer: B

    Centralized analytics with normalized data correlates cross-zone events. Separate logs, printed reviews and short retention prevent correlation.

  5. Question 5

    A company must maintain production during a cyber incident in its enterprise network. Which principle guides OT operations during the incident?

    1. AAllow attackers into OT to observe their actions so defenders can record techniques and tooling for future threat intelligence
    2. BShut down OT immediately regardless of safety and restart only after the vendor confirms the malware is removed from all sites
    3. CKeep the OT zone protected and operating safely, using predefined isolation and manual fallback where necessary
    4. DConnect OT to the enterprise network to get updates so that updates can be pulled directly from the corporate IT update servers
    Show answer and explanation
    Correct answer: C

    Predefined isolation with safe operation and manual fallback protects production. Unplanned shutdowns, connecting OT to compromised networks and enabling attacker access are wrong.

  6. Question 6

    A forensics team must investigate an incident on an OT historian without affecting data collection. Which approach is most suitable?

    1. ACollect logs and images from copies or replicas, with a documented chain of custody
    2. BPower off the historian to make a full disk image during production hours and skip the hash check
    3. CEdit records to correct errors before analysis in the historian so trend charts match expected values
    4. DDelete logs to speed the investigation and purge old tag history quickly
    Show answer and explanation
    Correct answer: A

    Working from copies or replicas preserves evidence and operations. Powering off, deleting logs and editing records damage the investigation and integrity.

  7. Question 7

    An alert shows that a device is communicating with an external IP address that is not in any approved list. The OT team needs to assess the impact. Which information is most useful?

    1. AThe device's serial number only printed on the nameplate, recorded in the procurement database and the vendor ticket
    2. BThe device's role in the process, its communication history, and whether the traffic is expected
    3. CThe date the device was purchased, its warranty term, the purchase order number and the reseller name
    4. DThe colour of the cable and its jacket material, shielding type, and the cable tray route used for the Modbus link
    Show answer and explanation
    Correct answer: B

    Process role and communication history determine impact and expectedness. Serial numbers, cable colour and purchase dates do not assess the risk.

  8. Question 8

    A company is establishing metrics for its OT security programme. Which measure reflects operational effectiveness?

    1. AThe total number of OT devices bought this quarter
    2. BThe number of printed policy binders kept in the control room cabinet
    3. CMean time to detect and mean time to contain OT incidents
    4. DThe number of OT meetings held in each quarter
    Show answer and explanation
    Correct answer: C

    Detection and containment times measure operational effectiveness. Meetings, binders and purchase counts do not show effectiveness.

OT threats and risk (8 questions)

  1. Question 9

    A security team assesses a water utility and identifies that a single compromised engineering workstation could change PLC logic. What term describes this risk?

    1. ARegulatory compliance checklist line item
    2. BAttack path to safety-relevant control logic
    3. CRoutine scheduled maintenance window for patching
    4. DVendor asset warranty status and support contract expiry
    Show answer and explanation
    Correct answer: B

    A path from a workstation to control logic is an attack path with safety implications. Maintenance windows, checklists and warranties describe other concepts.

  2. Question 10

    An attacker gains access to an enterprise network and then moves toward the OT network through a shared jump host. Which control best limits this movement?

    1. ASegmentation between IT and OT with a controlled, monitored conduit
    2. BRemoving firewalls between IT and OT zones to simplify routing
    3. CSharing one flat Layer 2 VLAN network between IT and OT
    4. DAllowing unrestricted protocol traffic from IT hosts to OT
    Show answer and explanation
    Correct answer: A

    Segmentation with a controlled conduit limits movement between IT and OT. Flat networks, removing firewalls and allowing all protocols remove controls.

  3. Question 11

    A threat actor uses phishing to compromise an IT account that is later used to access an engineering system. What does this illustrate for OT security?

    1. AOT systems are fully insulated from IT-originated attacks by their proprietary protocols
    2. BIT compromises can cascade into OT when zones are not properly separated
    3. CPhishing mainly targets personal mobile devices rather than corporate accounts
    4. DEngineering systems are typically deployed without individual user accounts at sites
    Show answer and explanation
    Correct answer: B

    Cross-domain attacks can move from IT to OT if separation is weak. OT is not immune, phishing affects corporate accounts, and engineering systems do have accounts.

  4. Question 12

    A security analyst discovers that a remote vendor connects to a control network through an always-on VPN with shared credentials. Which risk is most important to address?

    1. AUnmonitored, shared remote access that bypasses accountability
    2. BThe number of concurrent VPN users during the day
    3. CThe VPN client's brand colour and interface theme
    4. DThe vendor's head office location and regional time zone
    Show answer and explanation
    Correct answer: A

    Shared credentials and always-on access reduce accountability and widen risk. Brand colour, location and user counts are not the main risk.

  5. Question 13

    A utility wants to reduce the risk from a known vulnerability in an OT device that cannot be patched for months. Which compensating control is most appropriate?

    1. AExpose the device directly to the internet through a public IP with port forwarding for vendor access
    2. BRestrict network access to the device with zone segmentation and monitor its traffic
    3. CDisable the device's event logging and syslog forwarding to the central collector for SOC review
    4. DDefer action on the vulnerability until a vendor-approved patch window becomes available
    Show answer and explanation
    Correct answer: B

    Segmentation and monitoring provide compensating controls when patches are delayed. Internet exposure, ignoring the issue and disabling logs increase risk.

  6. Question 14

    A risk assessment for an OT site considers both the likelihood and the impact of a cyber event on safety and production. Which concept combines these two?

    1. ARisk equals the count of PLC devices
    2. BRisk equals the age of the equipment
    3. CRisk equals the number of staff members
    4. DRisk equals likelihood multiplied by impact
    Show answer and explanation
    Correct answer: D

    Risk is commonly expressed as likelihood times impact. Device counts, equipment age and staff numbers are not the defining formula.

  7. Question 15

    A company's OT security policy requires zones and conduits to be defined for communication between systems. Which standard framework is most associated with this concept?

    1. AGDPR rules
    2. BIEC 62443
    3. CISO 9001
    4. DPCI DSS v4
    Show answer and explanation
    Correct answer: B

    IEC 62443 defines zones and conduits for industrial automation and control systems. PCI DSS covers cardholder data, HIPAA covers health information, and GDPR covers personal data privacy.

  8. Question 16

    A plant's engineering workstation is used to program PLCs, and it also connects to the internet for email. What is the main concern?

    1. AA dual-use workstation can expose the control environment to internet-borne threats
    2. BThe email client will consume workstation resources and slow the PLC programming session
    3. CThe workstation is too fast for the PLC and can overrun its scan cycle timing under heavy load
    4. DInternet connections can improve PLC performance by offloading logic processing to cloud services
    Show answer and explanation
    Correct answer: A

    A dual-use workstation can carry internet threats into the control environment. Speed concerns and performance claims are not the main issue.

OT architecture and protocols (7 questions)

  1. Question 17

    A plant engineer asks how the Purdue model organizes an industrial network. Which description is most accurate?

    1. AA flat network in which each device can communicate freely with each other device, with no separation between control and business layers
    2. BA model that is limited to describing wireless access points and their radio channel assignment tables in a plant's coverage area
    3. CA layered model from field devices at the bottom up to enterprise systems at the top, with segmentation between levels
    4. DA model limited to describing cloud-hosted SaaS applications and public internet services used by the enterprise in a hybrid deployment
    Show answer and explanation
    Correct answer: C

    The Purdue model layers OT from field devices (Level 0 to 1) up to supervisory and enterprise systems, with segmentation between levels. It is not flat, cloud-only, or wireless-only.

  2. Question 18

    In an industrial plant, which level of the Purdue model typically contains programmable logic controllers that directly control physical processes?

    1. ALevel 1 (basic control)
    2. BLevel 5 (external connections)
    3. CLevel 4 (enterprise)
    4. DLevel 3.5 demilitarized zone only
    Show answer and explanation
    Correct answer: A

    PLCs and basic control devices sit at Level 1 and directly interact with sensors and actuators. Enterprise and external levels are above, and the DMZ is a boundary rather than a control level.

  3. Question 19

    A supervisory control system collects data from field devices and presents it to operators. Which system is this?

    1. AERP
    2. BCRM
    3. CSCADA
    4. DEmail gateway
    Show answer and explanation
    Correct answer: C

    SCADA systems supervise industrial processes, collecting data and enabling operator control. ERP and CRM are business systems, and an email gateway is unrelated.

  4. Question 20

    A PLC communicates with a DCS controller using a common industrial protocol over TCP port 502. Which protocol is this?

    1. ASNMP v2c
    2. BSMTP mail
    3. CModbus TCP
    4. DHTTP REST
    Show answer and explanation
    Correct answer: C

    Modbus TCP uses TCP port 502 and is common in industrial environments. HTTP uses port 80, SMTP uses port 25, and SNMP uses UDP 161.

  5. Question 21

    A utility uses DNP3 for communication between substations and the control centre. Which characteristic of DNP3 is important for security assessments?

    1. AIt is restricted to office IT networks and is rarely found in substations
    2. BIt cannot be transported over IP networks because its framing is incompatible with standard TCP/IP stacks
    3. CIt is fully encrypted by default using TLS 1.3 with modern X.509 certificates and integrity checks at each hop
    4. DIt historically lacked native authentication and encryption, so it needs compensating controls
    Show answer and explanation
    Correct answer: D

    Many legacy industrial protocols, including DNP3 as commonly deployed, lack native authentication and encryption, so compensating controls are required. The other claims are inaccurate.

  6. Question 22

    An OT team must identify all assets in a plant, including PLCs, HMIs and sensors, without disrupting production. Which approach is most appropriate?

    1. APassive network monitoring that observes traffic to build an asset inventory
    2. BPhysically disconnecting each device one by one from its network port
    3. CActive port scanning of each PLC in the cell during production hours
    4. DRelying on vendor device lists alone, which can be incomplete
    Show answer and explanation
    Correct answer: A

    Passive monitoring builds asset inventories without impacting control devices. Active scanning can disrupt fragile PLCs, disconnecting devices halts production, and vendor lists may be incomplete.

  7. Question 23

    In industrial control environments, what is a major reason that patching is more difficult than in IT networks?

    1. APatching is prohibited by regulation for plants under NERC CIP oversight
    2. BPatches are not released for control systems since vendors avoid changing them
    3. CMany controllers run firmware without a general-purpose operating system
    4. DSystems often run continuously and patches may require downtime and vendor validation
    Show answer and explanation
    Correct answer: D

    OT systems often must run continuously, and patches require testing and vendor validation before application. Patches do exist, many systems run an OS, and patching is not prohibited generally.

OT network segmentation and defence (7 questions)

  1. Question 24

    An OT network design places a firewall between the enterprise zone and the industrial DMZ. Which rule type is most appropriate at this boundary?

    1. AAllow traffic based on source port only, which keeps the rule set short
    2. BAllow all traffic from the enterprise to the OT zone for operator convenience
    3. CAllow all traffic because both zones belong to the same company and share one IT policy
    4. DAllow only specific, necessary flows between zones and deny all others by default
    Show answer and explanation
    Correct answer: D

    Default-deny with explicit allowed flows is the recommended boundary policy. Allow-all rules and port-only rules weaken segmentation.

  2. Question 25

    An OT engineer wants to restrict which PLCs can be programmed remotely, using identity rather than IP addresses alone. Which Cisco approach supports identity-based access?

    1. AUsing broadcast addresses for access to PLC subnets from any host on the segment
    2. BStatic IP allowlists only, configured per PLC and updated by hand after each change
    3. CIdentity-based policy with Cisco ISE applied to OT devices and users
    4. DDisabling authentication on all devices to ease remote access during commissioning
    Show answer and explanation
    Correct answer: C

    Cisco ISE provides identity-based policy that can enforce access for OT devices and users. Static IP lists are weaker, disabling authentication is unsafe, and broadcast addresses are not access controls.

  3. Question 26

    A conduit between two zones carries only the protocol needed for data exchange. Which principle is applied?

    1. AMaximum data sharing between all zones to support reporting
    2. BUnlimited protocol use for flexibility across the conduit at all times
    3. CAllowing all ports for future needs on the conduit firewall overnight
    4. DLeast functionality through minimal, explicit protocol allowance
    Show answer and explanation
    Correct answer: D

    Least functionality limits conduits to required protocols and ports. Maximum sharing, unlimited protocols and open ports for future use increase exposure.

  4. Question 27

    An industrial firewall must inspect Modbus traffic and block write commands from unauthorized sources. Which capability is required?

    1. ADeep packet inspection for industrial protocols with function-code level policy
    2. BBasic port filtering only, matching TCP port 502 on the segment without reading the payload
    3. CBlocking all Modbus traffic at the conduit, including read polling and historian queries
    4. DAllowing all function codes on the Modbus TCP conduit so engineers face no delays for tuning
    Show answer and explanation
    Correct answer: A

    Industrial deep packet inspection can enforce function-code level policies, such as blocking unauthorized writes. Port filtering alone cannot distinguish function codes.

  5. Question 28

    A remote engineer needs access to a PLC network through a jump server in the DMZ. Which design is safest?

    1. ADisabling the jump server to reduce exposure, so engineers reach PLCs through a VPN concentrator on the internet edge
    2. BRemote access connects directly to the PLC network from the internet through a port-forwarded NAT rule on the perimeter firewall
    3. CShared admin accounts on the jump server, used by vendors, contractors and night shift operators with one password
    4. DRemote access terminates on the DMZ jump server with MFA, session recording, and restricted onward access
    Show answer and explanation
    Correct answer: D

    A DMZ jump server with MFA, recording and restricted onward paths is a standard secure pattern. Direct internet access, shared accounts and disabling the jump server are weaker or impractical.

  6. Question 29

    A security team wants to protect OT switches from unauthorized devices plugged into physical ports. Which control helps?

    1. ADisabling the switches on the OT network to block new devices
    2. BLeaving all ports open for convenience on the floor
    3. CUsing a hub instead of a switch for the cell network
    4. DPort security or 802.1X authentication on OT switch ports
    Show answer and explanation
    Correct answer: D

    Port security and 802.1X restrict device access to switch ports. Open ports, disabled switches and hubs do not provide the control.

  7. Question 30

    A network team wants to protect OT devices from ARP spoofing attacks inside a control VLAN. Which switch feature helps?

    1. ADynamic ARP inspection with DHCP snooping bindings
    2. BTurning off port security
    3. CAssigning static ARP entries only on the internet router
    4. DDisabling ARP completely in the control network
    Show answer and explanation
    Correct answer: A

    Dynamic ARP inspection validates ARP packets against trusted bindings, reducing spoofing. Disabling ARP breaks communication, static entries on the wrong device do not protect the VLAN, and port security is a separate control.