OT and SCADA Penetration Testing CPENT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A penetration tester has compromised a workstation on the IT network of a manufacturing company. The goal is to pivot into the OT network to reach a historian server. The OT network is segmented with a firewall that only allows specific IPs and ports. Which technique is most appropriate for the tester to establish a controlled pivot?

   • AUse a port forward on the compromised workstation to forward traffic from the attacker's machine to the historian server
   • BUse a VPN client on the compromised workstation to join the OT network
   • CUse a reverse SSH tunnel from the compromised workstation to the OT historian server
   • DUse a SOCKS proxy on the compromised workstation and route traffic through it to the OT network
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A penetration tester is performing passive reconnaissance on a railway signaling system. The tester has access to a SPAN port on the OT switch. Which data source would be most valuable for mapping the network topology without sending any packets?

   • AUse netflow data from the router to see traffic summaries.
   • BQuery the ARP cache of the switch to list all connected devices.
   • CAnalyze the captured traffic to identify protocol types, IP addresses, and communication patterns between devices.
   • DRead the configuration files of the HMI to identify all PLCs.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What type of information can be gathered from passive network monitoring in an OT environment?

   • AThe passwords used to authenticate to the SCADA server
   • BThe physical location of every device in the facility
   • CThe exact firmware version of every device on the network
   • DIP addresses, MAC addresses, and protocol identifiers of devices
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A penetration tester is assessing a water treatment facility that uses Modbus RTU over serial links between PLCs and a central SCADA server. The tester needs to passively map the register addresses and function codes used by the PLCs without sending any packets that could alter the process. Which approach best achieves this objective?

   • ARun a Modbus TCP port scan against the PLCs to enumerate open ports and then query each register with read commands
   • BUse a serial tap or a network TAP on the RS-485 bus and capture traffic with Wireshark, then parse the Modbus RTU frames offline
   • CUse an OPC client to connect to the SCADA server and read all tag values
   • DSend a broadcast write command to all PLCs to observe which ones respond with an exception
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A penetration tester has compromised an engineering workstation in the OT network of a water utility. The goal is to reach a PLC on a separate OT subnet that is protected by a firewall allowing only Modbus TCP from the engineering workstation's IP. The tester needs to maintain stealth and avoid disrupting the process. Which approach is the most effective?

   • AInstall a backdoor on the engineering workstation to maintain access and then use it to pivot later.
   • BSend a crafted Modbus write command to the PLC to test if the firewall allows writes.
   • CScan the PLC subnet from the engineering workstation to find other open ports.
   • DUse the engineering workstation's existing Modbus TCP connection to the PLC and send read requests to map the register space.
   Reveal Solution Discussion Select an answer first