OT and SCADA Attacks CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common vulnerability in OT/SCADA networks that arises from connecting control systems to corporate networks without proper separation?

   • AExcessive logging of process data
   • BRegular backup of control system configurations
   • CUse of encrypted communication protocols
   • DWeak network segmentation
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which security control is specifically designed to detect anomalous behavior on an OT network, such as unexpected Modbus commands to a PLC?

   • AEncryption of all OT communication
   • BRegular patching of all OT devices
   • CPhysical security controls like locks and cameras
   • DIntrusion detection system (IDS) tailored for industrial protocols
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which real-world OT/SCADA attack is known for using a worm that specifically targeted Siemens Step7 software to manipulate centrifuges in a nuclear facility?

   • AStuxnet
   • BUkraine power grid attack
   • CWannaCry ransomware
   • DNotPetya
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security architect is designing defenses for a power utility that has a legacy SCADA system with no possibility of patching or upgrading. The utility must allow remote vendor access for maintenance, but the OT network is flat and uses unauthenticated DNP3. The architect must choose a control that reduces the risk of a vendor account compromise leading to a disruptive attack, while keeping the system operational. Which control is most effective?

   • AReplace the DNP3 protocol with a modern authenticated protocol.
   • BDeploy an inline IPS that blocks all DNP3 traffic except from the HMI.
   • CImplement a jump server in a DMZ that requires MFA and records all sessions, and restrict vendor access to only the HMI.
   • DAllow vendors direct RDP access to the HMI but change the HMI password weekly.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A manufacturing company has a SCADA network with a mix of modern PLCs that support encrypted protocols and legacy PLCs that only speak plaintext Modbus. The company must allow a third-party vendor to perform diagnostics on the legacy PLCs remotely. The vendor's tools require direct Modbus access. The security team is concerned about exposing the legacy PLCs to the internet. Which solution best balances the vendor's requirement with security?

   • AAllow the vendor to connect directly to the HMI, which will translate the Modbus traffic to an encrypted protocol before reaching the PLCs.
   • BSet up a VPN concentrator in the DMZ and configure the vendor's access to terminate at a jump host that is the only device allowed to speak Modbus to the legacy PLCs.
   • CExpose the legacy PLCs to the internet via a port-forwarding rule, and require the vendor to use a strong password.
   • DReplace all legacy PLCs with modern ones that support encrypted protocols before allowing vendor access.
   Reveal Solution Discussion Select an answer first