OT and SCADA Attacks CEH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A water utility uses a legacy SCADA system where the HMI communicates with PLCs over an unencrypted serial-to-Ethernet gateway. The engineering team needs to reduce the risk of an attacker intercepting or replaying control commands, but they cannot replace the PLCs or the HMI software. Which control is the most practical first step?

   • AImplement an application-layer allowlist on the HMI so only the exact control commands used by operators are permitted.
   • BReplace the serial-to-Ethernet gateway with a cryptographic VPN concentrator that authenticates and encrypts all traffic between the HMI and PLCs.
   • CMove the HMI to a separate VLAN and enable port security on the switch to prevent unauthorized devices from connecting.
   • DDeploy a stateful firewall between the HMI network and the corporate network, and disable all inbound traffic from the corporate side.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a penetration test of a power utility, the tester gains access to a jump host on the corporate network. The goal is to reach the SCADA network, which is protected by a firewall that only allows traffic from specific engineering workstations. The tester has harvested credentials for an engineering workstation. Which methodology step is the tester most likely performing next?

   • AExploiting a known vulnerability in the SCADA HMI software directly from the jump host.
   • BUploading a malicious firmware update to the PLCs through the jump host's network connection.
   • CPivoting from the jump host to the engineering workstation and then using the harvested credentials to access the SCADA network.
   • DConducting a denial-of-service attack against the firewall to disable the rule that restricts source IP addresses.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which statement best describes the primary purpose of operational technology (OT) in an industrial environment?

   • ATo manage business applications such as email and customer relationship management
   • BTo store and process large volumes of transactional data for analytics
   • CTo monitor and control physical processes and industrial equipment
   • DTo provide secure remote access for employees to corporate networks
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security engineer is evaluating the attack surface of a wind farm's SCADA system. The system uses a satellite link to communicate with a central control center. Which of the following is a unique attack surface introduced by the satellite link?

   • AThe satellite link is slower than wired links, making it more susceptible to denial-of-service attacks.
   • BThe satellite link requires the use of a public IP address, making it accessible from the internet.
   • CThe satellite link uses a proprietary protocol that is difficult to secure.
   • DThe satellite link can be jammed or spoofed, allowing an attacker to disrupt or inject false data.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security researcher is analyzing a malware sample that spreads via removable drives and exploits a zero-day in a Windows-based HMI. Once inside the OT network, the malware modifies the ladder logic of PLCs while displaying normal operating values on the HMI. This behavior is most characteristic of which real-world attack?

   • AStuxnet, which used multiple zero-days and manipulated PLC logic while providing false feedback to the HMI.
   • BThe 2015 Ukraine power grid attack, where attackers used BlackEnergy to open breakers remotely.
   • CThe 2017 NotPetya outbreak, which encrypted files and disrupted shipping operations worldwide.
   • DThe Mirai botnet, which used default credentials on IoT devices to launch DDoS attacks.
   Reveal Solution Discussion Select an answer first