OT and SCADA Attacks CEH Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security analyst is investigating a suspected intrusion in a power plant's OT network. The analyst finds that a PLC's firmware was updated to a version that is not officially released by the vendor, and the HMI is displaying normal values despite the PLC being in an abnormal state. Which attack vector is most likely being used?

   • AA phishing attack that tricked an operator into downloading a malicious file.
   • BA direct network attack using a known exploit in the HMI software.
   • CA denial-of-service attack that caused the PLC to reboot and load a corrupted firmware.
   • DA supply chain compromise where the attacker tampered with the firmware update mechanism.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which characteristic of OT/SCADA environments creates a unique attack surface not typically found in traditional IT networks?

   • AUse of standard IT protocols like HTTP and SMTP
   • BCentralized management of all devices from a single console
   • CHigh availability of security patches for field devices
   • DPresence of legacy industrial protocols that lack built-in security
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A penetration tester is performing an assessment of a SCADA environment. The tester wants to identify all live hosts and open ports on the OT network without causing disruption. Which technique is most appropriate for this phase?

   • AUsing a port scanner with default settings to scan the entire OT subnet.
   • BSending crafted Modbus packets to all possible IP addresses to elicit responses.
   • CActive vulnerability scanning with aggressive timing to speed up the assessment.
   • DPassive network sniffing to observe traffic patterns and identify devices.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A chemical plant wants to implement an intrusion detection system for its SCADA network. The plant uses a mix of legacy protocols, including Modbus and DNP3, and the network carries time-critical control traffic. Which approach is most suitable for detecting anomalies without disrupting operations?

   • ADeploy a traditional IT IDS that only looks for known IT attack signatures.
   • BInstall an active inline IPS that blocks malicious traffic in real time.
   • CUse a host-based IDS on every PLC and RTU.
   • DDeploy a passive network tap that monitors traffic and uses protocol-aware signatures for Modbus and DNP3.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which security control is most effective in preventing an attacker who compromises the corporate IT network from directly accessing OT/SCADA devices?

   • AAntivirus software on HMIs
   • BNetwork segmentation
   • CStrong password policies for IT users
   • DData loss prevention (DLP) systems
   Reveal Solution Discussion Select an answer first