OT and SCADA Attacks CEH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security audit of a factory's OT network reveals that many PLCs still use default credentials and that the engineering workstation has direct internet access. The plant manager wants to reduce the risk of an attacker gaining control of the PLCs. Which combination of controls is the most effective first step?

   • AChange all default credentials and remove the engineering workstation's direct internet access.
   • BDisable the HMI and rely on manual control of the factory processes.
   • CInstall an antivirus solution on the PLCs and schedule daily scans.
   • DImplement a firewall rule that blocks all traffic from the PLCs to the internet, but allow the engineering workstation to browse the web.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After gaining access to an OT/SCADA network, which step in the attack methodology involves moving from the IT network to the OT network?

   • AReconnaissance
   • BLateral movement
   • CImpact
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security assessor is evaluating a SCADA system that uses DNP3 for communication between masters and outstations. The assessor finds that the DNP3 implementation does not support authentication, and the network is shared with the corporate IT network. The assessor must recommend a control that reduces the risk of an attacker injecting false commands, while minimizing the impact on operational latency. Which control is most appropriate?

   • ADeploy an inline IPS that inspects all DNP3 traffic and blocks malicious commands.
   • BUse application-layer encryption on the DNP3 traffic.
   • CReplace DNP3 with a modern protocol that supports authentication and encryption.
   • DSegment the DNP3 network from the IT network using a firewall that only allows specific DNP3 traffic between known masters and outstations.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cyber-physical security team is reviewing the 2015 Ukraine power grid attack to improve their own defenses. They note that the attackers used spear-phishing emails to deliver BlackEnergy malware, which then allowed remote access to the SCADA network. Which additional tactic used in that attack should the team also prepare for?

   • AUsing a wiper component to destroy data on the HMI and engineering workstations after the attack.
   • BExploiting a zero-day vulnerability in the PLC firmware to cause physical damage.
   • CDeploying ransomware to encrypt the SCADA servers and demand payment.
   • DUsing a USB worm to spread across the air-gapped OT network.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of a field device in a SCADA environment that could be targeted by an attacker?

   • AA corporate web server
   • BA temperature sensor connected to a PLC
   • CA database server storing historical process data
   • DAn email gateway
   Reveal Solution Discussion Select an answer first