OT and SCADA Attacks CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security researcher is comparing the 2015 Ukraine power grid attack and Stuxnet to identify common TTPs. Which of the following is a commonality between the two attacks?

   • ABoth attacks used a zero-day vulnerability in Microsoft Windows to gain initial access.
   • BBoth attacks used a wiper component to destroy data on the target systems.
   • CBoth attacks involved direct manipulation of PLC logic to cause physical effects.
   • DBoth attacks required deep knowledge of the target's industrial processes and network architecture.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hospital's building management system (BMS) controls HVAC and elevators using BACnet over IP. The BMS is on the same network as the hospital's administrative IT systems. The security team wants to reduce the risk of a ransomware attack spreading from IT to the BMS. Which control is the most effective?

   • ARequire all BMS operators to use a VPN when accessing the system from the IT network.
   • BSegment the BMS onto a separate network and enforce strict firewall rules between the IT and BMS networks.
   • CInstall an antivirus on the BMS controllers and schedule regular scans.
   • DDisable the BACnet protocol and use a proprietary protocol instead.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a SCADA system, which component is responsible for collecting data from field devices and sending control commands to them?

   • ACommunication router
   • BHuman Machine Interface (HMI)
   • CRemote Terminal Unit (RTU) or Programmable Logic Controller (PLC)
   • DMaster Terminal Unit (MTU)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A municipal water treatment plant has a SCADA system that uses radio frequency (RF) links to communicate with remote pumping stations. The plant manager is concerned about an attacker intercepting or injecting false data into the RF communications. Which security control is most directly applicable to this concern?

   • AImplementing encryption and authentication on the RF link, such as using a VPN or a protocol that supports security extensions.
   • BEnforcing strong password policies on the HMI and all engineering workstations.
   • CDisabling all remote access to the SCADA network and requiring physical presence for any changes.
   • DInstalling a network intrusion detection system (IDS) on the wired SCADA network to monitor for anomalies.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A red team is tasked with assessing a railway's signaling system. The team has identified that the signaling system uses a proprietary protocol over serial links, and the only way to access it is through a maintenance laptop that is physically connected to the system during maintenance windows. The red team has compromised the maintenance laptop but cannot maintain a persistent connection to it. Which approach would allow the red team to achieve their objective of disrupting signaling during a maintenance window?

   • AInstall a backdoor on the maintenance laptop that will execute a script when it is next connected to the signaling system.
   • BUse a rogue access point to intercept the signaling system's wireless communications.
   • CLaunch a phishing campaign against the signaling system's vendor to obtain credentials.
   • DAttempt to brute-force the signaling system's serial port password from the corporate network.
   Reveal Solution Discussion Select an answer first