SecOT+ Passive Monitoring OT Networks Quiz

1. Passive monitoring of SCADA systems typically focuses on detecting which type of anomaly?

Unusual command sequences or control values

Email spam in the control network

Slow network latency only

Users who log in too frequently

2. What is the relationship between passive monitoring and compliance in critical infrastructure?

Passive monitoring is never required by regulators

It provides audit trails and evidence of security monitoring required by standards like NERC CIP

It replaces all other security measures

It is only useful for non-critical systems

3. Which approach best combines passive monitoring with incident response in OT?

Waiting for alerts before investigating any activity

Continuous monitoring paired with documented playbooks for detected anomalies

Monitoring only during business hours

Relying solely on vendor-supplied security updates

4. Passive monitoring of industrial protocols like Profibus requires understanding which aspect?

The specific command syntax and expected response patterns

Only the IP addresses of connected devices

The physical location of all cables

The vendor's customer support phone number

5. In SecOT+ frameworks, what role does threat intelligence play in passive monitoring?

It replaces the need for monitoring sensors

It helps correlate observed behavior with known attack patterns

It encrypts all network traffic automatically

It eliminates the need for baselining

6. Which metric is most critical when evaluating passive monitoring effectiveness?

Number of alerts generated per hour

Accuracy of threat detection versus false positive rate

Total cost of hardware purchased

Employee satisfaction with security tools

7. What is a key limitation of purely passive monitoring in OT networks?

It consumes excessive bandwidth

It cannot detect threats inside encrypted channels

It requires real-time patching of devices

It prevents legitimate network traffic

8. Passive OT monitoring sensors are typically deployed at which network locations?

Only on employee workstations

Boundary points, DMZs, and critical control segments

Inside encrypted VPN tunnels only

On external cloud servers exclusively

9. In passive monitoring, what does 'deep packet inspection' (DPI) enable?

Detection of threats based on packet payload content

Faster hardware processing of all traffic

Elimination of the need for firewalls

Automatic patching of vulnerabilities

10. Which protocol is often used to transport flow data from network devices to a collection server?

SFlow or IPFIX

FTP

Telnet

SNMP v1

11. What is the primary advantage of passive monitoring in OT networks compared to active scanning?

It provides faster threat detection

It avoids disrupting critical operations

It eliminates the need for firewalls

It increases network bandwidth

12. What is the primary purpose of a data diode in OT security?

To amplify network signals

To allow one-way data flow while preventing reverse traffic

To encrypt all network communications

To automatically block malware

13. Which of these is a characteristic of anomaly detection in passive monitoring?

It requires constant manual rule updates

It compares current behavior against established baselines

It cannot detect encrypted traffic

It works only on switched networks

14. In OT environments, what is a 'zero-day' vulnerability?

A flaw unknown to the vendor and unpatched

A vulnerability that appears only on Mondays

A bug that affects legacy systems only

An intentional backdoor in firmware

15. Which tool is commonly used for passive network monitoring and packet analysis?

Nmap

Wireshark

Metasploit

Burp Suite

16. Passive monitoring typically uses which approach to detect threats?

Sending probe packets to test system responses

Analyzing existing traffic without injecting new data

Modifying firewall rules in real time

Disconnecting suspicious devices immediately

17. What does baselining in OT security refer to?

Installing antivirus software on all devices

Establishing normal network behavior to identify deviations

Removing outdated equipment from the network

Encrypting all data at rest

18. Which industrial protocol is commonly monitored passively to detect anomalies in manufacturing systems?

HTTP

MODBUS

SMTP

DNS

19. In passive OT monitoring, what is a 'tap' or 'span port'?

A firewall rule that blocks traffic

A physical or virtual point to copy network traffic for analysis

A protocol used for authentication

A sensor that measures temperature

20. Which of the following best describes network flow data (NetFlow)?

Raw packet payloads captured at wire speed

Summarized records of network conversations and traffic patterns

Real-time video feeds of network topology

Encrypted tunnel metadata only

SecOT+ Passive Monitoring Techniques for OT Networks Quiz