CompTIA SOT-001: CompTIA SecOT+

Last checked November 10, 2026 against the official CompTIA exam page.

1. Question 1OT Systems and Safety Foundations

   Which safety practice requires placing a personal lock and tag on an energy isolation point so that equipment cannot be re-energized during maintenance?

   1. ANetwork segmentation between production zones
   2. BChange freeze during peak production periods
   3. CLockout/tagout energy isolation procedure
   4. DDefense in depth across layered security controls
   Show answer and explanationHide answer

   Correct answer: C

   Lockout/tagout isolates hazardous energy sources and uses locks and tags so equipment cannot be re-energized while a worker is servicing it. Network segmentation, change freezes, and defense in depth are valid security or scheduling controls, but none of them isolates energy for a worker.

2. Question 2OT Risk Management

   A water utility buys insurance that pays for the financial losses caused by a possible control system outage, but it makes no change to how likely that outage is. Which risk treatment option is this?

   1. ARisk avoidance by removing the risky process entirely
   2. BRisk transfer through insurance coverage for losses
   3. CRisk mitigation through added technical safeguards
   4. DRisk acceptance with documented management sign-off
   Show answer and explanationHide answer

   Correct answer: B

   Transfer moves the financial impact to a third party such as an insurer without reducing the likelihood of the event. Avoidance removes the activity, mitigation adds controls that lower likelihood or impact, and acceptance keeps the risk knowingly.

3. Question 3OT Threat Intelligence

   An analyst documents a suspected intrusion at a substation by recording who is behind it, which malware and tools were used, which servers the attacker controlled, and which utility system was targeted. Which analytic model is the analyst applying?

   1. AMITRE ATT&CK Enterprise matrix for tactics and techniques
   2. BCyber Kill Chain stages for tracking attack phases
   3. CDiamond Model of intrusion analysis for adversary pivots
   4. DPyramid of Pain for judging indicator durability over time
   Show answer and explanationHide answer

   Correct answer: C

   The Diamond Model links adversary, capability, infrastructure, and victim for each intrusion event and is used to pivot across related activity. Kill chain stages, the ATT&CK matrix, and the Pyramid of Pain are useful references but do not center on those four linked elements.

4. Question 4OT Cybersecurity Architecture, Design, and Engineering

   A plant network places HMIs, PLCs, and the business email server on one flat subnet. The security team wants to limit how far an intruder can move after a single compromise. Which change best achieves this?

   1. APlace all devices in one large VLAN and rely on strong passwords
   2. BTurn on daily automatic updates for the business email server
   3. CGroup OT assets into zones with controlled conduits between them
   4. DEnable Wi-Fi on every HMI so operators can roam between machines
   Show answer and explanationHide answer

   Correct answer: C

   Zones and conduits, as described in IEC 62443, limit lateral movement by controlling which traffic can cross between groups of OT assets. A single flat VLAN with passwords, automatic email server updates, or roaming Wi-Fi on HMIs does not restrict movement between zones.

5. Question 5OT Incident Management

   A plant has an approved incident response plan, trained staff, tested offline backups, and a vendor contact list, all in place before any attack occurs. Which PICERL phase does this work represent?

   1. APreparation of plans, tools, and trained staff
   2. BEradication of malicious code from affected systems
   3. CIdentification of unusual activity on controllers
   4. DLessons learned review after the incident is closed
   Show answer and explanationHide answer

   Correct answer: A

   Preparation covers plans, tools, training, and backups built before any attack happens. Identification, eradication, and lessons learned are phases that begin after an incident is detected or has been contained.