SecOT+ OT Forensics Without Disrupting Operations

1. Which data source provides real-time insight into OT system behavior during incidents?

Historical backups only

System logs and network flows captured live

Archived emails from six months ago

Deleted temporary files

2. In OT forensics, how does live memory analysis support non-disruptive investigation?

It requires immediate system shutdown

It captures volatile data without powering down critical systems

It eliminates the need for any evidence collection

It prevents future incident detection

3. What is the role of a forensic hash in OT evidence management?

To encrypt sensitive data

To verify evidence has not been altered or corrupted

To accelerate system recovery

To delete evidence automatically

4. Which step should occur immediately after detecting an OT incident?

Restart all systems

Isolate and document without immediate shutdown

Delete suspicious files

Notify only IT leadership

5. In SecOT+ incident management, what is 'graceful degradation' in forensics?

Collecting evidence while allowing partial system operation

Complete system failure during investigation

Ignoring security events

Removing all security controls

6. Which forensic artifact is most vulnerable to loss in OT systems?

Printed reports

RAM contents and real-time sensor data

Archived records from years ago

Static configuration files

7. Why is documenting the OT environment critical before forensic collection?

To speed up evidence deletion

To establish baseline state and support timeline reconstruction

To avoid incident investigation

To hide operational details

8. In OT forensics, what does 'evidence integrity' require?

Modifying data to match investigation findings

Maintaining accurate records of all collection and handling steps

Destroying original evidence immediately

Sharing evidence with unauthorized parties

9. Which challenge is unique to forensics in operational technology?

Lack of forensic tools

Need to preserve evidence while maintaining critical operations

Abundance of easily accessible data

Absence of regulatory requirements

10. What is the purpose of creating a forensic image in OT incident management?

To take a complete snapshot for analysis without altering the original

To accelerate system shutdown

To delete evidence automatically

To prevent future backups

11. What is the primary goal of forensics in OT incident management?

Identify root cause while preserving system availability

Shut down systems immediately for evidence preservation

Document all network traffic for legal purposes

Replace all affected equipment before investigation

12. In SecOT+ frameworks, what does 'minimal disruption' mean during forensics?

Avoiding investigation entirely

Collecting evidence while maintaining normal operations

Destroying evidence to prevent exposure

Ignoring security incidents

13. Which forensic tool is commonly used for non-invasive OT network monitoring?

Packet analyzers and protocol decoders

Hard disk wipers

Password reset utilities

System defragmentation software

14. What is the primary risk of taking a system offline for forensics in OT?

Loss of volatile data and operational continuity

Increased evidence preservation

Faster incident resolution

Improved system security

15. Which of the following is a non-disruptive forensic collection method?

Network packet sniffing with monitoring tools

Forced system restart and disk imaging

Unplugging equipment immediately

Deleting suspicious files during investigation

16. In OT incident response, why is live forensics preferred over offline analysis?

It eliminates the need for backups

It captures volatile memory and active process states without shutdown

It guarantees faster system recovery

It prevents any future security incidents

17. What does volatile data in OT forensics refer to?

Data stored on hard drives

Information lost when power is removed

Encrypted files requiring decryption

Data transmitted over wireless networks

18. Which forensic artifact is most critical to preserve in SCADA systems?

Browser cache files

Memory dumps and real-time process states

Desktop wallpaper settings

Email server logs only

19. In OT environments, what is chain of custody primarily used for?

Tracking equipment maintenance schedules

Establishing evidence integrity and legal admissibility

Monitoring employee access badges

Recording system uptime metrics

20. Which approach minimizes operational disruption during OT forensic investigation?

Live forensics with real-time monitoring

Complete system isolation and offline analysis

Immediate evidence destruction to prevent leaks

Relying solely on network logs without system access

SecOT+ OT Forensics Without Disrupting Operations Quiz