OT and SCADA Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common SCADA protocol that uses a master/slave model and typically operates over TCP port 502?

   • AEtherNet/IP
   • BDNP3
   • COPC UA
   • DModbus
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester has discovered that a Schneider Electric Modicon M340 PLC is running a vulnerable firmware version that allows remote code execution via the Modbus protocol. The tester is authorized to exploit this vulnerability, but the PLC is controlling a critical conveyor belt. What is the safest way to proceed?

   • AExploit the vulnerability immediately to avoid losing the opportunity.
   • BExploit the vulnerability during a scheduled maintenance window when the conveyor belt is stopped.
   • CExploit the vulnerability but only read the PLC's memory, not write to it.
   • DAsk the operator to watch the conveyor belt and stop it manually if something goes wrong.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is new to OT and is asked to assess a water distribution system. The tester notices that the OT network uses a flat topology with no segmentation between the control center and field devices. Which of the following is the most significant security implication of this architecture?

   • AIt makes passive reconnaissance easier because all traffic is visible on the same segment
   • BIt simplifies the deployment of firewalls because there are fewer zones
   • CIt increases the attack surface because a compromise of any single device can lead to lateral movement to all other devices
   • DIt reduces the need for encryption because the network is isolated
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is assessing a power utility that uses DNP3 for communication between the master station and RTUs. The tester needs to enumerate the RTUs and their point tables without causing a failover or disrupting the SCADA system. Which approach is the most appropriate?

   • ASend DNP3 write requests to set the RTU's time to test its response.
   • BPerform a TCP port scan on the RTUs to identify open ports.
   • CUse a vulnerability scanner to check for known DNP3 CVEs.
   • DUse a DNP3 client to send read requests for object 0 (device attributes) and object 60 (class data) to each RTU.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is assessing a mining operation's OT network that uses Profinet for communication between PLCs and field devices. The tester needs to enumerate the Profinet devices and their IP addresses without causing any disruption. Which technique is most appropriate?

   • AUse a generic network scanner to send TCP SYN packets to all ports
   • BUse a protocol fuzzer to send random Profinet frames
   • CUse a Profinet scanner tool that sends DCP identify requests to the network
   • DUse a packet capture on the network and analyze the Profinet traffic
   Reveal Solution Discussion Select an answer first