OT and SCADA Penetration Testing CPENT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is reviewing the OT network architecture of a food processing plant. The plant has a DMZ between the IT and OT networks, but the tester finds that the firewall rules allow any-to-any communication between the DMZ and the OT control network. What is the most critical recommendation to improve the security posture?

   • AAdd a second DMZ to create more separation
   • BImplement a stateful firewall with allow-list rules that only permit specific protocols and IPs
   • CReplace the DMZ with a direct connection between IT and OT to reduce complexity
   • DUse a VLAN to separate the DMZ and OT networks
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the role of a 'conduit' in an OT network architecture?

   • ATo physically connect all OT devices to a single network switch
   • BTo provide a controlled communication path between zones, often with security controls like firewalls
   • CTo store backup data for OT systems
   • DTo provide power to OT devices in the field
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A penetration tester is assessing a manufacturing plant that has a flat OT network with no segmentation between the HMI, PLCs, and a wireless access point used by maintenance engineers. The tester has compromised the wireless access point. Which attack path is the most likely to succeed in reaching the PLCs?

   • AScan the IT network first to find a jump host to the OT network.
   • BPivot from the wireless access point directly to the PLCs because the flat network allows unrestricted access.
   • CUse a rogue device to create a separate network and then bridge to the OT network.
   • DExploit the HMI first to gain credentials, then use them to access the PLCs.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester has compromised a workstation in the IT network of a manufacturing company. The tester needs to pivot to the OT network to reach a PLC. The OT network is segmented with a firewall that only allows specific IPs and ports. Which approach is most likely to succeed while minimizing detection?

   • AUse a legitimate remote access tool that is already allowed through the firewall, such as an engineering workstation's remote desktop service.
   • BUse a VPN tunnel from the compromised workstation to a server in the OT network.
   • CScan the OT network from the compromised workstation to find open ports on the PLC.
   • DSet up a rogue access point in the OT network to bypass the firewall.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A penetration tester has identified that a PLC is using a default password for its web interface. The tester wants to exploit this to gain access to the PLC's configuration. What is the most important consideration before attempting to log in?

   • ALog in from a different IP address to avoid being traced.
   • BEnsure that the login attempt will not trigger a lockout or disrupt the PLC's operation.
   • CChange the password after logging in to maintain access.
   • DUse the default password only once to avoid detection.
   Reveal Solution Discussion Select an answer first