Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is investigating a breach in an OT environment. The initial entry point was a phishing email sent to an employee in the corporate IT department. The attacker then moved laterally to the OT network. Which attack vector is described?

   • ADirect network intrusion from the internet into the OT network.
   • BSpear-phishing as the initial vector, followed by lateral movement from IT to OT.
   • CPhysical intrusion into the plant's control room.
   • DSupply chain attack via compromised third-party software.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common IoT vulnerability that arises from manufacturers shipping devices with easily guessable login credentials?

   • ADefault credentials
   • BBuffer overflow
   • CLack of update mechanism
   • DInsecure communication
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A mobile app development team wants to integrate security testing into their CI/CD pipeline. They need to identify common vulnerabilities like insecure data storage and hardcoded secrets before release. Which tool or technique is best suited for this automated, pre-release phase?

   • ARun a static analysis tool like MobSF on the compiled APK/IPA to scan for known insecure patterns and secrets.
   • BReview the app's source code manually for any hardcoded secrets and insecure storage APIs.
   • CPerform manual penetration testing on a physical device after each release candidate is built.
   • DUse a dynamic analysis tool like Frida to hook into the app at runtime and intercept function calls.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which technique is recommended to mitigate risks when performing penetration testing on live OT systems?

   • AUsing default credentials to test all devices quickly
   • BUsing a test environment that mirrors the production OT network
   • CRunning all tests without prior approval to avoid alerting operators
   • DDisabling safety systems during testing to get accurate results
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security consultant is evaluating a new IoT device for a client. The device uses default credentials, communicates over HTTP, and has no mechanism for firmware updates. Which vulnerability is the most critical to address first?

   • ALack of firmware update mechanism, as it prevents patching of future vulnerabilities.
   • BDefault credentials, as they allow immediate unauthorized access to the device.
   • CInsecure communication over HTTP, as it allows eavesdropping and tampering.
   • DThe device's open network ports, as they expose services to the network.
   Reveal Solution Discussion Select an answer first