OT and SCADA Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration tester is conducting passive reconnaissance on a hospital's building management system (BMS) that controls HVAC and elevators. The tester has access to a SPAN port on the BMS network switch. Which of the following is the most effective passive technique to identify the BMS controllers and their firmware versions?

   • ACapture traffic and look for HTTP headers that may contain server or firmware information
   • BUse a DNS zone transfer to enumerate BMS hostnames
   • CUse a MAC address lookup to identify the vendor and then guess the firmware
   • DUse a network scanner to send ICMP pings to the BMS subnet
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the context of OT network architecture, what is the primary purpose of a 'zone'?

   • ATo provide a physical barrier between the OT network and the internet
   • BTo group assets with similar security requirements and enforce consistent security policies
   • CTo replace the need for firewalls and other security devices
   • DTo allow unrestricted communication between all devices in the same facility
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an OT penetration test, what is 'pivoting'?

   • AUsing a compromised system as a relay to access other networks or devices
   • BThe act of rotating through multiple penetration testing tools
   • CThe process of physically moving from one location to another during the test
   • DChanging the IP address of the attacker's machine to avoid detection
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After completing an OT penetration test, the tester must write a report for both technical staff and plant management. The report includes a critical vulnerability in a PLC that could allow remote shutdown. What is the best way to present this finding to ensure both audiences understand the risk?

   • AUse a risk matrix to show the likelihood and impact, and provide a plain-language summary for management
   • BProvide a detailed technical explanation of the exploit and include the proof-of-concept code
   • CInclude a video of the exploit being performed
   • DOnly include the technical details and let management ask questions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an OT penetration test at a power utility, the tester identifies that the DNP3 protocol is used between the control center and remote substations. The tester wants to model threats that could cause a denial of service to the substation communications. Which threat modeling approach is most appropriate to identify specific DNP3-related attack vectors?

   • APerform a port scan of the substation RTUs to identify open DNP3 ports
   • BRun a vulnerability scanner against the DNP3 stack to find known CVEs
   • CReview firewall logs to see if any DNP3 traffic has been blocked
   • DUse STRIDE to categorize threats such as spoofing of DNP3 master addresses and tampering with DNP3 application layer messages
   Reveal Solution Discussion Select an answer first