A security consultant is reviewing the OT network of a food processing plant. The plant uses a mix of Ethernet/IP and DeviceNet protocols. The consultant discovers that the engineering workstation has a dual-homed NIC, one connected to the corporate network and one to the OT network. This configuration is a risk because it:

Causes the OT network to be slower due to the additional NIC.

Prevents the engineering workstation from accessing the internet, which is required for updates.

Allows malware from the corporate network to directly reach the OT network, bypassing any firewall.

Requires the use of a different protocol stack on each NIC, which can cause conflicts.

A security team is analyzing the Stuxnet attack to understand how it targeted SCADA systems. They note that Stuxnet exploited a zero-day vulnerability in Windows and then used a rootkit to hide its presence on the HMI, while also modifying the PLC logic. Which aspect of Stuxnet's TTPs is most characteristic of a targeted OT attack?

The use of a rootkit to hide files on the infected Windows systems.

The use of a zero-day Windows vulnerability to spread across networks.

The propagation via USB drives to cross air gaps.

The modification of PLC logic to cause physical damage while hiding the changes from the HMI.

A penetration tester is performing an assessment of a water treatment facility. The tester has gained access to the corporate network and is now trying to move into the OT network. The OT network is protected by a firewall that only allows traffic from a specific patch management server. Which technique would the tester most likely use to gain access to the OT network?

Use a zero-day exploit against the PLCs directly from the corporate network.

Send a phishing email to OT operators to trick them into installing a remote access tool.

Compromise the patch management server and use it as a pivot point to reach the OT network.

Exploit a vulnerability in the firewall to disable the access control list.

A security consultant is assessing a wind farm's SCADA system. The turbines communicate with the central control center via a microwave link, and the control center is connected to the corporate network. The consultant identifies that the microwave link is unencrypted and can be intercepted. Which control would best mitigate the risk of an attacker intercepting and modifying turbine control commands?

Disconnect the control center from the corporate network.

Deploy an IDS on the control center network to detect anomalies.

Replace the microwave link with a fiber-optic cable.

Implement encryption on the microwave link, such as using a VPN tunnel between the turbines and the control center.

Which attack vector involves an attacker gaining access to an OT/SCADA system by compromising a third-party vendor that provides software or hardware to the industrial facility?

Exploitation of protocol weaknesses

EC-CouncilCertified Ethical Hacker

Domain 7Objective 5

OT and SCADA Attacks CEH Practice Questions (Page 10)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 46–50

46expert · medium
A security consultant is reviewing the OT network of a food processing plant. The plant uses a mix of Ethernet/IP and DeviceNet protocols. The consultant discovers that the engineering workstation has a dual-homed NIC, one connected to the corporate network and one to the OT network. This configuration is a risk because it:
Select an answer first
47application · medium
A security team is analyzing the Stuxnet attack to understand how it targeted SCADA systems. They note that Stuxnet exploited a zero-day vulnerability in Windows and then used a rootkit to hide its presence on the HMI, while also modifying the PLC logic. Which aspect of Stuxnet's TTPs is most characteristic of a targeted OT attack?
Select an answer first
48application · medium
A penetration tester is performing an assessment of a water treatment facility. The tester has gained access to the corporate network and is now trying to move into the OT network. The OT network is protected by a firewall that only allows traffic from a specific patch management server. Which technique would the tester most likely use to gain access to the OT network?
Select an answer first
49expert · hard
A security consultant is assessing a wind farm's SCADA system. The turbines communicate with the central control center via a microwave link, and the control center is connected to the corporate network. The consultant identifies that the microwave link is unencrypted and can be intercepted. Which control would best mitigate the risk of an attacker intercepting and modifying turbine control commands?
Select an answer first
50foundation · easy
Which attack vector involves an attacker gaining access to an OT/SCADA system by compromising a third-party vendor that provides software or hardware to the industrial facility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

OT and SCADA Attacks CEH Practice Questions (Page 10)

Questions 46–50

Which attack vector involves an attacker gaining access to an OT/SCADA system by compromising a third-party vendor that provides software or hardware to the industrial facility?

Keep studying — Mobile, IoT and OT Hacking