FSCE-OT Practice Test

FSCE-OT practice test: what's covered

• OT Fundamentals & Purdue Model
• eyeInspect Architecture
• Passive Asset Discovery
• Industrial Protocol Analysis
• Threat Detection & Baselines
• Operations & Integration

Free FSCE-OT sample questions

1. An engineer is mapping a plant network to the Purdue reference model and must place the programmable logic controllers that directly command field devices. Which level do they belong to?

   • A. Level 0, the physical process layer containing sensors and actuators
   • B. Level 3, the site operations layer containing historians and engineering workstations
   • C. Level 4, the enterprise business layer containing ERP and corporate systems
   • D. Level 1, the basic control layer containing PLCs and other controllers
   Show answer

   Correct: D. Level 1 is the basic control layer where PLCs, RTUs and DCS controllers execute logic against the process. Level 0 is the physical instrumentation they command, Level 3 holds site operations systems such as historians, and Level 4 is corporate IT outside the control system entirely.

2. A security architect must explain why active vulnerability scanning is discouraged on a Level 1 control network. Which reasoning is most accurate?

   • A. Industrial protocols encrypt all traffic so scan results would be meaningless
   • B. Regulatory frameworks prohibit any form of asset inventory in OT environments
   • C. Legacy controllers can fault or halt the process when they receive unexpected probe traffic
   • D. Active scanning cannot detect any devices on industrial network segments
   Show answer

   Correct: C. Many industrial controllers have limited network stacks and can crash or enter a fault state when scanned, which risks physical process disruption and safety. Active scanning does find devices, most industrial protocols are unencrypted rather than encrypted, and regulations require asset inventory rather than prohibiting it.

3. An engineer is applying IEC 62443 zone and conduit concepts to a plant. Select the TWO statements that correctly describe the model. (Choose TWO)

   • A. A conduit removes the need to monitor traffic once it has been defined
   • B. Zones are defined solely by the manufacturer of the equipment they contain
   • C. A zone groups assets sharing common security requirements and risk tolerance
   • D. A conduit is the controlled communication path between two zones
   • E. A zone must always correspond exactly to one physical VLAN in the network
   Show answer

   Correct: C and D. Zones group assets by shared security requirements and conduits are the deliberately controlled paths between them, which is the foundation of segmentation in the standard. Zones are logical rather than tied to a single VLAN, defining a conduit increases rather than removes the need to monitor it, and vendor identity is not a zoning criterion.

4. A plant manager asks why availability is prioritised over confidentiality in OT security planning. Which explanation is correct?

   • A. Loss of control system availability can cause physical harm and production loss
   • B. Industrial data has no commercial value so confidentiality is irrelevant
   • C. OT networks are physically isolated so confidentiality is guaranteed already
   • D. Confidentiality controls are technically impossible on industrial protocols
   Show answer

   Correct: A. In OT the primary consequence of a security event is a physical one, so keeping the process running safely outranks protecting data secrecy. Industrial data does have value, physical isolation is rarely absolute in practice, and confidentiality controls are difficult rather than impossible.

5. An engineer must monitor traffic at a remote substation and aggregate the findings centrally. Which eyeInspect component performs the local traffic analysis?

   • A. The Command Center, which must be installed at every monitored substation
   • B. An eyeSegment policy engine deployed on the substation control network
   • C. A span port configured on the corporate core switch at headquarters
   • D. A sensor deployed at the substation performing deep packet inspection locally
   Show answer

   Correct: D. Sensors are deployed where the traffic is and perform local inspection, reporting findings to the central Command Center. The Command Center is the central aggregation and management tier rather than a per-site component, eyeSegment addresses segmentation policy, and a headquarters span port cannot see substation traffic.

Last updated: 2026-10-07

FSCE-OT practice test FAQ