SecOT+ OT Incident Response Plan Development Quiz

1. Which factor makes OT incident severity assessment different from IT?

Physical safety impact, production loss, and regulatory compliance are primary concerns

Data confidentiality is the only consideration in OT

OT severity is assessed identically to IT incidents

Severity assessment is unnecessary in OT environments

2. In OT incident response, what does 'lessons learned' review accomplish?

Identifies root causes, improves procedures, and prevents recurrence of similar incidents

Lessons learned reviews are unnecessary after incidents

Only IT incidents benefit from post-incident analysis

Reviews delay recovery and should be avoided

3. What is the primary advantage of integrating OT incident response with business continuity planning?

Ensures coordinated response across operations, IT, and management to minimize impact

Incident response and business continuity are unrelated

Only IT systems require continuity planning

Integration complicates the response process

4. Why is training and awareness essential for OT incident response plan success?

Personnel must recognize threats, follow procedures, and execute their assigned roles during incidents

Training is unnecessary; staff will know what to do automatically

Only IT staff require incident response training

Awareness programs are a waste of time and resources

5. What should happen during the 'recovery' phase of an OT incident?

Restore systems in sequence while validating functionality and safety before resuming operations

Immediately restore all systems simultaneously

Skip recovery and assume systems will fix themselves

Recovery only applies to IT systems

6. Which metric is essential for measuring OT incident response effectiveness?

Mean time to detect, contain, and restore operations after incidents

Only the cost of security software matters

Metrics are not needed for incident response

Only IT incidents require performance metrics

7. What is the benefit of segmenting OT networks during incident response planning?

Limits lateral movement of threats and reduces blast radius of incidents

Segmentation makes incident response more difficult

Network segmentation is unnecessary in OT environments

Segmentation only applies to IT networks

8. Why should supply chain and vendor dependencies be included in incident planning?

To understand recovery time for parts, patches, and support during incidents

Vendors are irrelevant to incident response

Only internal resources matter in incident response

Supply chain planning is only for IT systems

9. In OT incident response, what is a 'safe mode' of operation?

A predefined operational state that maintains safety while reducing functionality

A feature that eliminates all security controls

An operation mode that increases production speed

A state that requires no human oversight

10. What role should law enforcement play in an OT incident response plan?

Pre-established contact procedures for reporting and coordinating on criminal incidents

Law enforcement should never be contacted

Only IT incidents require law enforcement involvement

The organization should handle all incidents without external assistance

11. What is the primary purpose of an OT incident response plan?

To minimize downtime and protect safety-critical systems during security incidents

To increase IT spending on security tools

To eliminate all cybersecurity risks

To replace traditional OT maintenance schedules

12. What is the purpose of conducting tabletop exercises for OT incident response?

To identify gaps in the plan and train personnel before real incidents occur

To waste time and resources

To guarantee no incidents will ever happen

To replace actual incident response procedures

13. Why is documentation critical during and after an OT incident?

To enable forensic analysis, improve future response, and meet compliance requirements

Documentation is not necessary for incident response

Only IT incidents require documentation

To delay incident resolution and recovery

14. In OT incident response, what does 'air-gapping' accomplish?

Physically isolates compromised systems from the network to prevent spread

Improves network speed and performance

Eliminates the need for other security controls

Automatically patches all vulnerabilities

15. Which communication channel should be established before an incident occurs?

Pre-defined escalation procedures and contact lists for all stakeholders

Only social media announcements

Email chains with no clear ownership

Informal phone calls to random personnel

16. What is a key difference between containment in IT versus OT incident response?

OT containment must preserve operational continuity and worker safety

OT systems can be shut down immediately without consequences

Containment strategies are identical for IT and OT

OT incidents do not require containment measures

17. Which role is essential in an OT incident response team?

OT operations engineer who understands process control systems

Only external consultants with no facility knowledge

Marketing representatives

Human resources specialists exclusively

18. What should be the first step when developing an incident response plan for OT?

Identify and classify critical assets and operational dependencies

Purchase expensive security software immediately

Blame vendors for all security issues

Assume incidents will never occur in your facility

19. In OT environments, why is the distinction between IT and OT critical for incident response?

OT systems prioritize availability and safety; IT prioritizes confidentiality and integrity

OT and IT have identical security requirements

OT systems do not require security measures

IT incident response procedures work unchanged in OT environments

20. Which of the following is a critical component of OT asset inventory?

Network topology, device firmware versions, and operational dependencies

Employee vacation schedules and office locations

Marketing budgets and sales projections

Customer contact information and billing records