OT and SCADA Attacks CEH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security researcher is analyzing a new malware strain found in a SCADA environment. The malware spreads via USB drives and uses a stolen digital certificate to sign its driver. It also contains modules that specifically target Siemens PLCs and can rewrite their logic. Which combination of TTPs is most indicative of a state-sponsored OT attack?

   • APLC logic modification only, with no propagation mechanism.
   • BStolen certificate and generic ransomware that encrypts files on the HMI.
   • CUSB propagation, stolen certificate, and targeted PLC logic modification.
   • DUSB propagation and a stolen certificate, but no PLC-specific code.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is studying the Stuxnet attack to improve the organization's defenses. The analyst notes that Stuxnet used a man-in-the-middle attack to intercept and modify communications between the HMI and PLCs. Which defensive control would be most effective in detecting this type of attack?

   • AUsing a firewall to block all traffic between the HMI and PLCs except for the specific IP addresses.
   • BDeploying an antivirus on the HMI to detect malware.
   • CImplementing integrity checks on the communication between the HMI and PLCs, such as cryptographic hashes.
   • DIncreasing the frequency of HMI screen refreshes to spot anomalies faster.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A water treatment facility uses a legacy SCADA system with Modbus TCP between the PLCs and the HMI. The OT network is isolated from the corporate IT network by a firewall, but the firewall allows any traffic from the IT network to reach the OT network on port 502. During a security assessment, you discover that the PLCs accept writes from any host that can reach them. Which control would most directly reduce the risk of an attacker on the IT network modifying PLC setpoints?

   • AInstall an antivirus solution on the HMI and all PLCs to prevent malware from sending malicious Modbus commands.
   • BReplace the Modbus TCP protocol with a modern protocol that supports authentication and encryption.
   • CDisable the firewall and rely on the air gap between the IT and OT networks.
   • DConfigure the firewall to allow only the HMI's IP address to initiate connections to the PLCs on port 502.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is studying the 2015 Ukraine power grid attack to improve their own OT defenses. They note that the attackers gained access to the corporate network via phishing, then moved laterally to the OT network, and finally used the HMI to open breakers. Which control would have been most effective in preventing the final disruptive action?

   • ASegmenting the OT network from the corporate network with a firewall that restricts HMI access to authorized operators.
   • BImplementing multi-factor authentication on the corporate email system.
   • CPatching the HMI software against known vulnerabilities.
   • DDeploying an intrusion detection system on the corporate network.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a breach at a power utility. The analyst finds that the initial compromise occurred through a vendor's remote maintenance account, which had weak credentials and was not protected by MFA. The attacker used this account to access the OT network and modify control logic. Which attack vector best describes this incident?

   • ASupply chain compromise
   • BExploitation of protocol weaknesses
   • CDirect network access
   • DCredential compromise via remote access
   Reveal Solution Discussion Select an answer first