OT and SCADA Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is it important to exploit OT vulnerabilities in a 'controlled manner' during a penetration test?

   • ATo avoid using any automated tools during the test
   • BTo prevent the target organization from detecting the test
   • CTo ensure that the penetration test is completed as quickly as possible
   • DTo avoid causing unintended physical damage or safety incidents
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A tester is assessing a wind farm that uses OPC UA for communication between the SCADA server and wind turbine controllers. The tester wants to enumerate the OPC UA server endpoints and data points without disrupting the process. Which tool or technique is most appropriate?

   • AUse an OPC UA client to browse the server's address space and read node metadata
   • BUse Nmap to scan for OPC UA ports and then send crafted packets to crash the server
   • CUse a protocol fuzzer to send random data to the OPC UA server
   • DUse a web browser to access the OPC UA server's built-in web interface
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a mitigation strategy to reduce the operational impact of active scanning on a live OT network?

   • APerforming the scan during a scheduled maintenance window when the process can be safely stopped
   • BDisabling all alarms and alerts during the scan to avoid false positives
   • CUsing the fastest possible scan to minimize the time the network is affected
   • DScanning only the most critical devices to save time
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of an actionable remediation recommendation in an OT penetration testing report?

   • AAdvise that all employees be trained on cybersecurity awareness
   • BSuggest that the organization stop using the OT network entirely
   • CSegment the OT network into zones and restrict traffic between them using firewalls
   • DRecommend that all OT devices be replaced with newer models immediately
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is performing reconnaissance on a manufacturing plant's OT network. The plant uses a Purdue Model with Level 3 (site operations) and Level 2 (control systems) separated by a firewall. The tester has access to a workstation on Level 3. Which technique is most appropriate to discover Level 2 devices without crossing the firewall?

   • ASend ARP requests to the Level 2 subnet to map live hosts
   • BUse a rogue DHCP server on Level 3 to trick Level 2 devices into sending traffic
   • CUse a network scanner to sweep the Level 2 subnet directly from the Level 3 workstation
   • DAnalyze NetFlow or packet captures from the Level 3 switch to identify IP addresses and protocols used by Level 2 devices
   Reveal Solution Discussion Select an answer first