IoT and OT Security CCT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An engineer is reviewing the network architecture of a power utility that follows the Purdue model. The engineer notices that a workstation in the control center (Level 3) is able to directly communicate with a field device on the process network (Level 0) using DNP3. What is the primary security concern with this architecture?

   • AThe workstation should be moved to Level 2 to be closer to the field devices
   • BIt violates the Purdue model's segmentation, allowing a compromised Level 3 host to directly issue commands to safety-critical field devices
   • CDNP3 is an outdated protocol that cannot be encrypted, so all data is exposed
   • DThe field device should be upgraded to support OPC UA to improve security
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A global manufacturer operates OT facilities in multiple countries. They must comply with both IEC 62443 and local data residency regulations. The company wants to implement a centralized security monitoring solution. Which approach best satisfies both requirements?

   • AUse a single on-premises SIEM at headquarters and transfer all data there
   • BDo not monitor OT networks to avoid compliance issues
   • CDeploy a centralized SIEM in the cloud with regional data residency options
   • DDeploy a separate SIEM in each country and aggregate alerts to a central dashboard
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A cybersecurity analyst is investigating a suspected intrusion in a natural gas pipeline's OT network. The analyst finds that an attacker gained access to a human-machine interface (HMI) and sent unauthorized commands to a programmable logic controller (PLC) using the Modbus protocol. Which mitigation would have been most effective in preventing this specific attack?

   • AEncrypting all Modbus traffic with TLS
   • BDisabling the HMI's USB ports
   • CImplementing network segmentation between the HMI and PLC with an allowlist of permitted Modbus function codes
   • DInstalling antivirus software on the HMI
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A water treatment facility uses a legacy SCADA system that relies on Modbus TCP to communicate between a control server and remote terminal units (RTUs). The facility's network team wants to reduce the risk of an attacker sending malicious commands to the RTUs. Which control is most effective without requiring replacement of the legacy equipment?

   • ADeploy an application-layer firewall that inspects Modbus function codes and restricts allowed commands
   • BEnable encryption on the Modbus TCP traffic using TLS
   • CReplace all RTUs with new models that support OPC UA
   • DIncrease the timeout value on the RTUs to reduce false alarms
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which standard is specifically developed for the security of industrial automation and control systems (IACS)?

   • AISO 27001
   • BIEC 62443
   • CNIST SP 800-53
   • DGDPR
   Reveal Solution Discussion Select an answer first