Exam Bundle

A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard. That observation would verify another scenario: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The corrective step for that other scenario is: Coordinate containment with the process owner and safety procedures, using staged isolation where appropriate. But Timberline Foods is evaluating: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The necessary outcome is: The cloud receiver accepts authorized devices only and network inspection cannot read protected telemetry payloads.

Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue. That observation would verify another scenario: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The corrective step for that other scenario is: Segment roles with explicit OT firewall rules and controlled jump-host access, considering operational safety constraints. But Timberline Foods is evaluating: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The necessary outcome is: The cloud receiver accepts authorized devices only and network inspection cannot read protected telemetry payloads.

A general office user cannot view restricted streams while approved operators retain necessary access. That observation would verify another scenario: A camera management platform exposes device inventory and live streams to any authenticated office user regardless of role. The corrective step for that other scenario is: Enforce per-device authorization, least-privilege roles and audit records for sensitive video access. But Timberline Foods is evaluating: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The necessary outcome is: The cloud receiver accepts authorized devices only and network inspection cannot read protected telemetry payloads.

Coordinate containment with the process owner and safety procedures, using staged isolation where appropriate. This is an appropriate control for a different issue: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The Juniper Media finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Use segmented OT zones and controlled brokered remote access with named approval and monitoring. This is an appropriate control for a different issue: An industrial controller network is directly routed to the public internet to simplify vendor maintenance. The Juniper Media finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Require vendor-approved passive discovery or a validated maintenance-window test procedure for sensitive OT devices. This is an appropriate control for a different issue: A manufacturing engineer schedules active vulnerability probes against fragile programmable logic controllers during peak production. The Juniper Media finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

A copied factory password cannot administer another installed gateway and approved management remains available. That observation would verify another scenario: A smart building gateway ships with a universal administrator password shared across every deployed device. The corrective step for that other scenario is: Replace default credentials with unique managed identities and restrict device-management access. But Juniper Media is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

An external test cannot reach controller interfaces directly and authorized vendor sessions are recorded through the access gateway. That observation would verify another scenario: An industrial controller network is directly routed to the public internet to simplify vendor maintenance. The corrective step for that other scenario is: Use segmented OT zones and controlled brokered remote access with named approval and monitoring. But Juniper Media is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard. That observation would verify another scenario: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The corrective step for that other scenario is: Coordinate containment with the process owner and safety procedures, using staged isolation where appropriate. But Juniper Media is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Issue scoped per-device credentials with rotation, inventory ownership and independent revocation. This is an appropriate control for a different issue: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The Meadowbrook Finance finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Require vendor-approved passive discovery or a validated maintenance-window test procedure for sensitive OT devices. This is an appropriate control for a different issue: A manufacturing engineer schedules active vulnerability probes against fragile programmable logic controllers during peak production. The Meadowbrook Finance finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Use segmented OT zones and controlled brokered remote access with named approval and monitoring. This is an appropriate control for a different issue: An industrial controller network is directly routed to the public internet to simplify vendor maintenance. The Meadowbrook Finance finding instead concerns: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. It does not demonstrate the required correction. The decisive test remains: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

The authorized assessment identifies assets without interrupting control signals or operational availability. That observation would verify another scenario: A manufacturing engineer schedules active vulnerability probes against fragile programmable logic controllers during peak production. The corrective step for that other scenario is: Require vendor-approved passive discovery or a validated maintenance-window test procedure for sensitive OT devices. But Meadowbrook Finance is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

The cloud receiver accepts authorized devices only and network inspection cannot read protected telemetry payloads. That observation would verify another scenario: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The corrective step for that other scenario is: Apply mutual authentication or equivalent trusted identities and encrypted transport suited to device capabilities. But Meadowbrook Finance is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Revoking a single test device's token does not disconnect the rest of the authorized fleet. That observation would verify another scenario: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The corrective step for that other scenario is: Issue scoped per-device credentials with rotation, inventory ownership and independent revocation. But Meadowbrook Finance is evaluating: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The necessary outcome is: Ordinary office devices cannot initiate controller administration while approved safety-monitoring flows continue.

Coordinate containment with the process owner and safety procedures, using staged isolation where appropriate. This is an appropriate control for a different issue: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The Eastshore Energy finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Require vendor-approved passive discovery or a validated maintenance-window test procedure for sensitive OT devices. This is an appropriate control for a different issue: A manufacturing engineer schedules active vulnerability probes against fragile programmable logic controllers during peak production. The Eastshore Energy finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Segment roles with explicit OT firewall rules and controlled jump-host access, considering operational safety constraints. This is an appropriate control for a different issue: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The Eastshore Energy finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

A general office user cannot view restricted streams while approved operators retain necessary access. That observation would verify another scenario: A camera management platform exposes device inventory and live streams to any authenticated office user regardless of role. The corrective step for that other scenario is: Enforce per-device authorization, least-privilege roles and audit records for sensitive video access. But Eastshore Energy is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Every meter has a responsible owner and outdated units are isolated or replaced according to reviewed risk deadlines. That observation would verify another scenario: A smart meter remains deployed despite unsupported firmware and no asset record linking it to a maintenance owner. The corrective step for that other scenario is: Maintain lifecycle inventory, approved patch exceptions and a documented replacement or compensating-control plan. But Eastshore Energy is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Devices reject a tampered update image and a valid approved update completes successfully. That observation would verify another scenario: A sensor fleet lacks a secure firmware-update process and accepts update files from an unauthenticated network share. The corrective step for that other scenario is: Require signed firmware, verified update provenance and a tested recovery/rollback path. But Eastshore Energy is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Require signed firmware, verified update provenance and a tested recovery/rollback path. This is an appropriate control for a different issue: A sensor fleet lacks a secure firmware-update process and accepts update files from an unauthenticated network share. The Alpine Healthcare finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Enforce per-device authorization, least-privilege roles and audit records for sensitive video access. This is an appropriate control for a different issue: A camera management platform exposes device inventory and live streams to any authenticated office user regardless of role. The Alpine Healthcare finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Apply mutual authentication or equivalent trusted identities and encrypted transport suited to device capabilities. This is an appropriate control for a different issue: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The Alpine Healthcare finding instead concerns: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. It does not demonstrate the required correction. The decisive test remains: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

A copied factory password cannot administer another installed gateway and approved management remains available. That observation would verify another scenario: A smart building gateway ships with a universal administrator password shared across every deployed device. The corrective step for that other scenario is: Replace default credentials with unique managed identities and restrict device-management access. But Alpine Healthcare is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Every meter has a responsible owner and outdated units are isolated or replaced according to reviewed risk deadlines. That observation would verify another scenario: A smart meter remains deployed despite unsupported firmware and no asset record linking it to a maintenance owner. The corrective step for that other scenario is: Maintain lifecycle inventory, approved patch exceptions and a documented replacement or compensating-control plan. But Alpine Healthcare is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

The authorized assessment identifies assets without interrupting control signals or operational availability. That observation would verify another scenario: A manufacturing engineer schedules active vulnerability probes against fragile programmable logic controllers during peak production. The corrective step for that other scenario is: Require vendor-approved passive discovery or a validated maintenance-window test procedure for sensitive OT devices. But Alpine Healthcare is evaluating: A building automation system reuses the same cloud API token on hundreds of field devices and cannot revoke one compromised unit. The necessary outcome is: Revoking a single test device's token does not disconnect the rest of the authorized fleet.

Apply mutual authentication or equivalent trusted identities and encrypted transport suited to device capabilities. This is an appropriate control for a different issue: An IoT data collector forwards telemetry to cloud endpoints using an unauthenticated plaintext protocol across an untrusted link. The Brookside Manufacturing finding instead concerns: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. It does not demonstrate the required correction. The decisive test remains: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.

Replace default credentials with unique managed identities and restrict device-management access. This is an appropriate control for a different issue: A smart building gateway ships with a universal administrator password shared across every deployed device. The Brookside Manufacturing finding instead concerns: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. It does not demonstrate the required correction. The decisive test remains: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.

Segment roles with explicit OT firewall rules and controlled jump-host access, considering operational safety constraints. This is an appropriate control for a different issue: A water treatment site uses one flat network for operator workstations, engineering laptops and process controllers. The Brookside Manufacturing finding instead concerns: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. It does not demonstrate the required correction. The decisive test remains: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.

A copied factory password cannot administer another installed gateway and approved management remains available. That observation would verify another scenario: A smart building gateway ships with a universal administrator password shared across every deployed device. The corrective step for that other scenario is: Replace default credentials with unique managed identities and restrict device-management access. But Brookside Manufacturing is evaluating: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The necessary outcome is: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.

Devices reject a tampered update image and a valid approved update completes successfully. That observation would verify another scenario: A sensor fleet lacks a secure firmware-update process and accepts update files from an unauthenticated network share. The corrective step for that other scenario is: Require signed firmware, verified update provenance and a tested recovery/rollback path. But Brookside Manufacturing is evaluating: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The necessary outcome is: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.

An external test cannot reach controller interfaces directly and authorized vendor sessions are recorded through the access gateway. That observation would verify another scenario: An industrial controller network is directly routed to the public internet to simplify vendor maintenance. The corrective step for that other scenario is: Use segmented OT zones and controlled brokered remote access with named approval and monitoring. But Brookside Manufacturing is evaluating: An OT incident response playbook calls for immediately shutting down a controller that regulates a safety-critical process. The necessary outcome is: A tabletop proves the incident team can reduce network exposure without creating an uncontrolled physical safety hazard.