OT and SCADA Attacks CEH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which attack vector against OT/SCADA systems typically begins with a malicious email sent to an employee who works in the control center?

   • ASupply chain compromise
   • BDirect network access
   • CPhishing
   • DExploitation of protocol weaknesses
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing plant's OT network uses Modbus TCP to control robotic arms. A security analyst notices that a workstation on the corporate network has been sending read requests to a PLC's holding registers at regular intervals for the past week. The analyst suspects reconnaissance. Which characteristic of the Modbus protocol makes this activity particularly dangerous?

   • AModbus TCP automatically executes any command received, including firmware updates, without operator approval.
   • BModbus TCP has no built-in authentication or authorization, so any device that can reach the PLC can read or write its registers.
   • CModbus TCP uses a proprietary encryption algorithm that is easily broken with modern tools.
   • DModbus TCP broadcasts all traffic to every device on the network, allowing passive sniffing of all registers.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A chemical plant has a SCADA system that is critical for safety. The plant's management wants to implement a security monitoring solution, but the OT network has limited bandwidth and the PLCs are old and sensitive to network latency. Which monitoring approach is most appropriate?

   • ADeploy an active vulnerability scanner that regularly scans all PLCs for known vulnerabilities.
   • BInstall a host-based intrusion detection system (HIDS) on each PLC.
   • CUse a cloud-based SIEM that requires continuous streaming of all OT network traffic.
   • DImplement passive network monitoring using SPAN ports or network taps to analyze traffic without sending packets to the PLCs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is assessing a natural gas pipeline's OT environment. The tester has successfully phished an employee and gained access to the corporate network. The next step is to identify the SCADA network's IP address range and the types of PLCs in use. Which methodology phase is the tester currently in?

   • AReconnaissance and scanning of the OT network to map the environment.
   • BActions on objectives, such as opening a valve or changing a setpoint.
   • CCommand and control (C2) establishment with the SCADA servers.
   • DDelivery of the exploit payload to the PLCs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security consultant is assessing a natural gas pipeline's SCADA system. The consultant identifies that the RTUs use a proprietary serial protocol over radio links, and the HMI is connected to the corporate network for reporting. Which characteristic of the RTU communication links represents a unique OT attack surface?

   • AThe corporate network connection exposes the HMI to ransomware.
   • BThe radio links are susceptible to interception and jamming, which could allow an attacker to inject false data or disrupt communications.
   • CThe RTUs are vulnerable to SQL injection through the HMI.
   • DThe proprietary protocol is immune to attacks because it is not widely known.
   Reveal Solution Discussion Select an answer first