OT and SCADA Attacks CEH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An oil refinery has a SCADA network with legacy PLCs that cannot be patched. The corporate IT team wants to allow remote engineers to access the HMI for monitoring, but the security team insists on minimizing the attack surface. Which approach best balances the need for remote access with the constraint of unpatched legacy devices?

   • APlace a jump server in a DMZ and require multi-factor authentication for access to the HMI, while keeping the PLCs on a separate network segment.
   • BExpose the HMI directly to the internet with a strong password so engineers can connect from anywhere.
   • CSet up a VPN concentrator in the DMZ that terminates remote connections, and use a one-way data diode to replicate HMI data to a read-only monitoring server.
   • DInstall a host-based firewall on each PLC to block all incoming traffic except from the HMI.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is investigating an incident at a manufacturing plant where the production line was halted. The investigation reveals that an attacker gained access to the plant's business network via a phishing email, then used a legitimate remote desktop tool to jump to an engineering workstation, and finally sent unauthorized commands to a PLC using the engineering software. Which combination of controls would have been most effective in preventing this attack chain?

   • AEmail filtering and a host-based IDS on the PLC.
   • BNetwork segmentation and a strong password policy for the engineering workstation.
   • CMulti-factor authentication on remote access, network segmentation between IT and OT, and application allowlisting on the engineering workstation.
   • DAntivirus on the engineering workstation and a firewall between IT and OT.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which attack on the Ukraine power grid is notable for using spear-phishing emails to deliver malware that allowed attackers to remotely open circuit breakers?

   • AUkraine power grid attack (2015)
   • BStuxnet
   • CMirai botnet
   • DWannaCry ransomware
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A utility company is planning to connect its OT network to a cloud-based monitoring service for predictive maintenance. The OT network uses legacy protocols and has limited bandwidth. The security team is concerned about exposing the OT network to the internet. Which architecture best balances the need for cloud monitoring with security?

   • AUse a unidirectional gateway to send OT data to the cloud, with no inbound connections allowed.
   • BUse a cloud-based SCADA system that replaces the legacy OT network entirely.
   • CConnect the OT network directly to the cloud via a VPN tunnel.
   • DPlace a firewall between the OT network and the cloud, allowing all traffic from the cloud to the OT network.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing logs from a SCADA environment and notices that an attacker performed a port scan of the OT network, then used a default password to log into a PLC's web interface, and finally sent unauthorized commands to a pump. Which phase of the attack methodology does the use of the default password represent?

   • AReconnaissance
   • BWeaponization
   • CGaining access
   • DActions on objectives
   Reveal Solution Discussion Select an answer first