OT and SCADA Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration tester is planning an active scan of a chemical plant's OT network. The plant uses DNP3 for substation automation and has a strict safety policy that any unexpected traffic could cause a trip. What is the most important mitigation strategy to include in the test plan?

   • AUse only passive techniques to avoid any active traffic
   • BUse a low-and-slow scan rate to minimize the chance of triggering alarms
   • CScan only during non-production hours to reduce operational impact
   • DCoordinate with the control room and have a rollback plan for any device that goes offline
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When threat modeling an OT environment, which of the following is a primary concern that differs from traditional IT threat modeling?

   • AThe need to protect intellectual property stored on engineering workstations
   • BThe need to encrypt all data at rest in the database
   • CThe requirement to ensure high availability of email services
   • DThe potential for physical damage or safety hazards to humans and the environment
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a known vulnerability of the DNP3 protocol?

   • AIt is designed to operate only over serial links, making it immune to network attacks
   • BIt is a proprietary protocol that cannot be analyzed by security tools
   • CIt lacks built-in authentication, allowing an attacker to inject or modify messages if they can access the network
   • DIt uses weak encryption that can be easily broken with modern hardware
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of exploiting a protocol weakness in an OT environment?

   • ASending a crafted Modbus write command to change a setpoint on a PLC without authentication
   • BUsing a SQL injection attack on a web server
   • CExploiting a buffer overflow in a Windows workstation
   • DPerforming a man-in-the-middle attack on an HTTPS connection
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When performing active scanning in an OT environment, which of the following is a critical consideration to minimize the risk of disruption?

   • AScanning all ports on every device to ensure thorough coverage
   • BLimiting the scan rate and using safe, non-intrusive scan types
   • CUsing default Nmap settings without any modifications
   • DUsing aggressive timing options to complete the scan quickly
   Reveal Solution Discussion Select an answer first