OT and SCADA Attacks CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant uses a SCADA system with a mix of legacy and modern PLCs. The plant's OT network is flat, and remote vendors require direct RDP access to the HMI for troubleshooting. Which combination of controls would best reduce the risk of a vendor compromise affecting the OT network?

   • AInstall a firewall between the HMI and the PLCs to block all traffic.
   • BDisable all remote access and require vendors to travel to the site for every issue.
   • CPlace the HMI in a DMZ and require vendors to connect through a jump host with multi-factor authentication, logging all sessions.
   • DAllow vendors to connect directly to the HMI via RDP but change the default password.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which vulnerability is commonly found in OT/SCADA systems due to the difficulty of scheduling maintenance windows?

   • ALack of security patches
   • BDefault credentials left unchanged
   • CUnsecured physical access to control rooms
   • DWeak encryption on wireless networks
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team is conducting a tabletop exercise based on the 2015 Ukraine power grid attack. They want to test their response to a scenario where attackers have gained access to the SCADA network and are planning to open breakers. Which defensive control would be most effective in preventing the attackers from successfully opening breakers?

   • AIncreasing the frequency of HMI screen refreshes to detect changes faster.
   • BDisabling the HMI's remote access capability.
   • CImplementing an allowlist of authorized commands on the HMI that can be sent to the breakers.
   • DUsing a different protocol for breaker control that is not known to attackers.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A food processing plant uses a SCADA system that has been in operation for 15 years. The PLCs run a real-time operating system that is no longer supported by the vendor, and the plant cannot afford a full upgrade. Which mitigation is most appropriate to reduce the risk from the unsupported PLCs?

   • AUpgrade the PLCs' firmware to the latest version available from the vendor.
   • BPlace the PLCs on a separate network segment with strict firewall rules that only allow necessary traffic.
   • CInstall the latest antivirus software on the PLCs.
   • DDisconnect the PLCs from the network and rely on manual operation.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A red team is tasked with assessing the security of a nuclear research facility's OT environment. The facility has strict air-gap controls, but the red team discovers that a vendor's laptop, which is used for PLC programming, is also used to check personal email. The red team plans to use this as an initial foothold. Which attack methodology is most appropriate for the red team to follow?

   • ACompromise the facility's corporate email server and send a malicious link to the vendor.
   • BUse a USB drive dropped in the facility parking lot to infect the vendor's laptop when plugged in.
   • CAttempt to directly access the OT network from the internet by exploiting a vulnerability in the PLC's web interface.
   • DPhish the vendor with a malicious email that installs a backdoor on the laptop, then use the laptop's authorized access to the PLCs to deliver a payload.
   Reveal Solution Discussion Select an answer first