Cisco Certified OT Security Practitioner

Analyze an industrial cyber incident to identify the threat actor, attack path, operational impact, and safety consequences, including ransomware and nation-state activity.

Map PLCs, RTUs, HMIs, DCS components, enterprise services, and an industrial DMZ to Purdue levels 0–5 and trace a representative control-system data flow.

Distinguish Modbus TCP, Modbus serial, and DNP3 by their communication model, common ports or serial characteristics, industrial use cases, and observable packet fields.

Distinguish EtherNet/IP and PROFINET by their communication behavior, common ports or EtherTypes, industrial use cases, and observable packet fields.

Identify IEC 61850, OPC UA, and MQTT traffic from protocol characteristics, common ports, publish/subscribe or client/server behavior, and industrial use cases.

Apply ISA/IEC 62443 zones, conduits, and security levels; NIST CSF functions; and NIS2 baseline requirements to a small industrial facility.

Demonstrate OT fundamentals through three scenario-based exam questions and a Wireshark/Purdue-mapping practical challenge, then justify each answer in terms of safety and availability.

Construct and interpret a Cisco IE switch baseline configuration that disables unused ports, removes insecure HTTP and Telnet management, and preserves required industrial communications.

Configure and verify switchport security, sticky MAC learning, MAC-address limits, violation actions, and safe recovery using Cisco IOS/IE configuration and show-command outputs.

Design a protected switch management plane using out-of-band access or an isolated management VLAN, SSH, local AAA, and role-based administrative privileges.

Configure and verify 802.1Q access and trunk ports that segment representative Purdue-level OT zones without disrupting required control traffic.

Build and evaluate extended ACLs between Purdue zones and an IT/OT industrial DMZ, using least privilege, rule ordering, counters, and logging.

Select baseline protections for an industrial wireless deployment based on plant-floor propagation, interference, availability, authentication, and segmentation risks.

Choose among industrial firewalls, deep packet inspection, and hardware data diodes for a stated boundary and explain the operational trade-offs of each.

Demonstrate infrastructure-security skills through three scenario-based exam questions and a provided Cisco IE configuration troubleshooting challenge, then justify the safe corrective action.

Select feasible access controls for shared operator terminals, legacy or safety equipment, and physically accessible industrial assets without obstructing emergency operations.

Diagram a secure remote-access path through controlled entry points and jump or bastion hosts that prevents direct external access to HMIs and engineering workstations.

Apply MFA, time-bounded access, session recording, approval, and revocation controls to a third-party industrial remote-maintenance scenario.

Apply industrial Zero Trust principles by requiring least privilege, explicit authorization, and continuous verification for an OT access request.

Create a role-to-permission matrix for operators, control engineers, administrators, field technicians, and external vendors in a representative plant.

Diagnose interface-state, speed/duplex, native-VLAN, allowed-VLAN, and trunking faults from provided Cisco IOS/IE configurations and show-command outputs.

Trace traffic dropped by an ACL using logs, counters, packet evidence, and a safety-aware change workflow, then propose the minimum corrective edit.

Demonstrate access-control and troubleshooting skills through three scenario-based exam questions and an HMI-to-PLC connectivity challenge, then explain why rejected fixes create operational risk.

Choose a safe visibility method using passive monitoring, SPAN, RSPAN, ERSPAN, or a network TAP, and explain when active probing could endanger operations.

Build an industrial asset and communication inventory from a supplied packet capture without actively scanning the control network.

Detect a rogue device, abnormal Modbus function code, or other protocol deviation by applying display filters, baselining behavior, and inspecting packet details in Wireshark.

Design a Cisco Cyber Vision sensor placement plan that captures required Purdue-level traffic while respecting bandwidth, resiliency, and operational constraints.

Interpret simulated Cisco Cyber Vision component maps, decoded telemetry, and communication graphs to identify assets, relationships, and suspicious flows.

Create an OT asset risk profile by combining CVE evidence, Purdue-level exposure, reachable attack paths, operational criticality, and safety impact.

Choose a remediation or compensating control for a vulnerable legacy asset by weighing patching downtime against virtual patching, ACL tightening, and micro-segmentation.

Demonstrate visibility and risk-assessment skills through three scenario-based exam questions and a simulated Cyber Vision/PCAP remediation challenge, then defend the selected response.