OT and SCADA Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A tester is enumerating a SCADA system that uses the OPC protocol for communication between the HMI and data historians. The tester wants to identify OPC servers and their exposed tags. Which technique is most appropriate?

   • ARun a vulnerability scanner against the OPC server to find known CVEs.
   • BSend raw TCP packets to port 135 to enumerate DCOM endpoints.
   • CPerform a UDP scan of port 4800 to find OPC UA servers.
   • DUse an OPC client to browse the OPC server's namespace and enumerate available tags.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A penetration tester has compromised a domain controller in the IT network of a utility company. The OT network is separated by a firewall that only allows specific IPs and ports, and the tester has no direct access to the OT network. The goal is to reach a historian server in the OT network. Which approach is the most likely to succeed?

   • AScan the OT network from the domain controller to find open ports on the historian.
   • BUse a VPN tunnel from the domain controller to the historian server.
   • CCreate a new firewall rule from the domain controller to allow all traffic to the OT network.
   • DUse the domain controller to reset the password of a service account that is allowed through the firewall to the historian.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A penetration tester is mapping an OT network for a chemical plant. The plant uses a Purdue model with Level 0 (field devices), Level 1 (PLC), Level 2 (HMI), Level 3 (site operations), and Level 4 (enterprise IT). The tester has access to the IT network and wants to discover OT devices without crossing into the OT zones. Which technique best achieves this?

   • AUse Shodan to search for the plant's public IP range and identify exposed OT devices.
   • BDeploy a network tap on the OT switch to capture traffic passively.
   • CQuery the enterprise DNS and DHCP logs for hostnames and IP addresses that correspond to OT device naming conventions.
   • DRun Nmap with the -sn flag against the OT subnets from a compromised IT host.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a threat modeling exercise for a power utility, the tester identifies that the DNP3 protocol is used between the master station and remote terminal units (RTUs). The tester notes that DNP3 supports unsolicited responses and that the RTUs are on a shared broadcast domain. Which attack vector should be prioritized in the threat model?

   • AAn attacker intercepting DNP3 traffic to read measurement data.
   • BAn attacker exploiting a buffer overflow in the RTU's web server.
   • CAn attacker spoofing a master station to send malicious control commands to RTUs.
   • DAn attacker performing a denial-of-service by flooding the broadcast domain with ARP requests.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A penetration tester is planning an active scan of a live OT network at a wastewater treatment plant. The plant uses a mix of Modbus and DNP3 protocols. The tester must identify all live hosts and open ports, but the safety team has mandated that no packet should be sent that could be interpreted as a write command. Which scanning strategy best balances safety and effectiveness?

   • AUse a UDP scan on common OT ports and then use DNP3 read requests
   • BUse a passive scan by capturing traffic and then use ARP requests to map the network
   • CUse a full TCP connect scan on all ports with a low rate
   • DUse a SYN scan on common OT ports and then use Modbus read commands to confirm the devices
   Reveal Solution Discussion Select an answer first