Free SOT-001 practice test: 30 questions with answers

Lockout/tagout isolates hazardous energy sources and uses locks and tags so equipment cannot be re-energized while a worker is servicing it. Network segmentation, change freezes, and defense in depth are valid security or scheduling controls, but none of them isolates energy for a worker.

A PLC executes control logic locally on field-level hardware, so it can act within its scan cycle even when an HMI or network link is unavailable. A historian stores data, a dashboard displays it, and a firewall filters traffic, so none of them runs the valve logic.

SCADA supervises geographically dispersed processes, collecting data and sending setpoints across wide areas from a central site. A local HMI, a historian that stores values, and an engineering workstation used for programming do not provide that supervisory function.

Modbus is an openly documented protocol used widely between HMI, SCADA, and PLC devices, and its traditional design has no built-in authentication or encryption. The single-vendor and default-encryption statements are false, so those options are wrong.

A continuously running process cannot be interrupted arbitrarily, so patches need uptime planning, testing, and vendor validation where required. The other options contain false claims: no patch cycle stops every exploit, and HMI servers usually run patchable operating systems.

Transfer moves the financial impact to a third party such as an insurer without reducing the likelihood of the event. Avoidance removes the activity, mitigation adds controls that lower likelihood or impact, and acceptance keeps the risk knowingly.

A high-likelihood, high-impact risk belongs at the top of the treatment queue, so budget goes there first. The lost badge is low on both scales, and treating qualitative ratings as unrankable or accepting the historian risk ignores that ransomware can disrupt operations.

Monitoring checks over time that implemented controls still work and that risk indicators stay within agreed thresholds. Vendor selection is procurement and drafting a methodology is planning, so neither is monitoring.

Change management in OT relies on testing and a rollback path so that a failed change can be undone and the process returned to a known safe state. Bypassing operations review, warranty records, and dropping documentation are not purposes of these controls.

The IEC 62443 series defines security requirements and practices for industrial automation and control systems. ISO/IEC 27001 covers general information security management, PCI DSS covers payment card data, and GDPR covers personal data, so none is specific to industrial control systems.

The Diamond Model links adversary, capability, infrastructure, and victim for each intrusion event and is used to pivot across related activity. Kill chain stages, the ATT&CK matrix, and the Pyramid of Pain are useful references but do not center on those four linked elements.

The ATT&CK for ICS matrix catalogs adversary tactics and techniques observed against industrial control systems. CVE entries describe individual vulnerabilities, NIST SP 800-88 covers media sanitization, and CIS Benchmarks give configuration baselines, so none of them catalogs ICS adversary behavior.

Stuxnet used zero-day exploits, spread through Windows engineering systems, and changed Siemens S7 PLC logic while hiding the changes from operators. WannaCry was a ransomware worm, Industroyer targeted grid protocols, and Triton targeted safety instrumented systems, so none of them fits this description.

TTPs describe how an adversary operates, which changes far less often than the servers, domains, or malware it swaps out. Domains, hashes, and IP addresses are indicators that an adversary can replace quickly, so they age out fast.

An Information Sharing and Analysis Center gathers and distributes threat information within a critical infrastructure sector and supports anonymized sharing among members. An internet provider, a managed security provider, and a certificate authority do not serve that purpose.

Zones and conduits, as described in IEC 62443, limit lateral movement by controlling which traffic can cross between groups of OT assets. A single flat VLAN with passwords, automatic email server updates, or roaming Wi-Fi on HMIs does not restrict movement between zones.

A Trusted Platform Module stores keys and records boot measurements that support integrity checks and secure boot decisions. A network offload engine, a UPS monitoring card, and a GPU encoder have no role in verifying boot integrity.

A monitored jump host with MFA provides named, time-limited access and records sessions, which covers each stated requirement. Direct port forwarding, a shared spreadsheet credential, and an always-open tunnel each fail the named-account or time-limit requirements.

A data diode and a unidirectional gateway enforce that information can only move in one direction, which supports OT-to-IT data sharing. A bidirectional VPN with administrative access permits traffic in both directions, and a shared domain administrator account breaks accountability and least privilege.

A zone groups assets with shared security requirements, and a conduit is the controlled communication path between zones. A honeypot and a sandbox are security tools, but they are not zones or conduits.

Preparation covers plans, tools, training, and backups built before any attack happens. Identification, eradication, and lessons learned are phases that begin after an incident is detected or has been contained.

Recording every transfer with time and handler, and hashing the image so its integrity can be verified later, both support chain of custody. Leaving evidence on the source device and editing timestamps both weaken the record.

In OT, isolating a host can stop a process or remove a safety function, so operations must confirm a safe state before containment. The other options describe an unnecessary order of work, an approval chain that is not a standard requirement, or a manual cleanup that does not address containment.

A scenario-specific playbook gives responders pre-approved steps to follow under pressure without improvising. A warranty document, a finance report, and a network diagram may be useful references, but they do not tell responders what to do first.

ICS4ICS adapts the Incident Command System structure to industrial control system incidents, giving a shared model for roles, communication, and resources. ITIL, COBIT, and ISO 9001 are useful management frameworks but are not built for coordinating an OT incident response.

An unknown device should be identified and assessed passively, since active probing or changes to a fragile device can disrupt operations. Removing it blindly, assuming it is harmless, or updating its firmware first each creates risk without establishing what the device is.

A SIEM correlates events into alerts that analysts investigate, so this one is a lead to check against change records rather than proof of compromise. The alert does not fix the logic or replace change management, which are separate functions.

Risk-based prioritization considers how important the asset is to the process, how easily it can be exploited, and how exposed it is to attackers. Alphabetical order, the age of the scanner, and vendor logos say nothing about actual risk.

Removable media and vendor files should be scanned on an isolated system and checked against the published firmware hash before use. Trusting the vendor, copying files to a personal device, or disabling antivirus each bypasses those safeguards.

Scheduled outages give OT teams time to test patches, prepare rollback steps, and coordinate with operators without interrupting production. Reducing vendor contacts, delaying disclosure, or skipping inventory records are not reasons for scheduling patches this way.