OT and SCADA Penetration Testing CPENT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is planning an active scan of a live electrical substation's OT network. The substation uses legacy devices that are known to be sensitive to network traffic. Which mitigation strategy should be included in the test plan?

   • ARun the scan at full speed to finish quickly and minimize the time window.
   • BSchedule the scan during a low-demand period and use a slow scan rate with a limited port range.
   • CUse active exploitation tools to test all known vulnerabilities in one pass.
   • DScan only the HMI and skip the PLCs to avoid direct interaction.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key difference between a penetration testing report for an OT environment and one for a traditional IT environment?

   • AThe OT report should not include technical details because operators are not technical
   • BThe OT report should be shorter because OT environments are less complex
   • CThe OT report should focus only on network-level findings and ignore application-level issues
   • DThe OT report must emphasize the potential safety and operational impact of each finding
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key difference between traditional IT networks and OT/SCADA networks?

   • AOT networks prioritize availability and safety over confidentiality, while IT networks often prioritize confidentiality and integrity
   • BOT networks have no need for security updates, while IT networks require regular patching
   • COT networks use only proprietary protocols, while IT networks use only standard TCP/IP protocols
   • DOT networks are always isolated from the internet, while IT networks are always connected to the internet
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A tester is performing active enumeration of a SCADA network that uses Modbus TCP. The tester needs to identify all PLCs and their register maps without causing a PLC to enter a fault state. Which approach minimizes the risk of disruption?

   • APerform a full TCP port scan on all 65535 ports of each PLC.
   • BSend write-single-register requests to test the PLC's response.
   • CUse the Nmap modbus-discover script without any rate limiting.
   • DUse a Modbus scanner that sends read-holding-register requests with a limited range and a delay between requests.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is developing a threat model for a smart grid environment. The environment includes a control center, substation RTUs, and a wide-area network using DNP3. The tester needs to identify the most likely attack path that could lead to a blackout. Which of the following is the most critical attack surface to consider?

   • AThe WAN links between the control center and substations
   • BThe DNP3 protocol stack on the RTUs
   • CThe physical security of the substation
   • DThe SCADA server's operating system
   Reveal Solution Discussion Select an answer first