OT and SCADA Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester has completed an OT assessment and found a critical vulnerability in a DNP3 implementation that could allow an attacker to send false control commands to a power grid substation. The client wants to know the risk in business terms. The tester must produce a report that is useful for both the CISO and the plant engineer. Which approach is most effective?

   • AProvide a single risk rating (e.g., 'Critical') and a technical description of the vulnerability
   • BProvide a detailed technical write-up with exploit code and a separate executive summary with a risk matrix
   • CProvide only the technical details and let the CISO ask for more information
   • DProvide a risk matrix with likelihood and impact, but omit the technical details
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester has completed an assessment of a natural gas pipeline's SCADA system. The final report needs to communicate risks to both technical and executive audiences. Which report structure best achieves this?

   • AFocus on the attack narrative and omit remediation recommendations.
   • BProvide only a list of vulnerabilities with CVSS scores.
   • CWrite a single technical report with all exploit steps and raw logs.
   • DInclude an executive summary with business impact and a technical section with detailed findings and remediation steps.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common attack surface in an OT/SCADA environment?

   • AThe absence of any remote access capabilities
   • BThe use of strong encryption on all OT protocols
   • CThe physical security of the facility, which is always well-protected
   • DHuman-Machine Interfaces (HMIs) that are accessible from the corporate network
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester has found a vulnerability in a Modbus TCP implementation that allows an attacker to write to arbitrary registers. The PLC controls a cooling system. The tester wants to demonstrate the impact without causing physical damage. Which action is the safest way to demonstrate the vulnerability?

   • AWrite to all registers to demonstrate the full extent of the vulnerability.
   • BWrite to a non-critical register that does not affect the cooling process, such as a diagnostic counter.
   • CWrite to the register that controls the alarm system to trigger an alarm.
   • DWrite to the register that controls the cooling pump speed to show the impact.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A junior penetration tester is joining an OT assessment for a food processing plant. The lead tester explains that OT networks prioritize availability and safety over confidentiality, and that the plant uses a mix of legacy serial protocols and modern Ethernet. Which statement best describes a key difference the junior tester should understand?

   • AOT networks use the same operating systems and protocols as IT, so testing can follow the same playbook.
   • BOT devices often have long lifecycles and may not support modern security patches, so testing must be more conservative.
   • COT networks are typically flat and have no segmentation, so pivoting is easier than in IT.
   • DConfidentiality is the top priority in OT, so encryption is mandatory on all OT protocols.
   Reveal Solution Discussion Select an answer first