Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A penetration tester is assessing an IoT device that uses a proprietary protocol over Wi-Fi. The tester wants to analyze the firmware for backdoors and hardcoded credentials. Which step should the tester perform first?

   • AIntercept the Wi-Fi traffic to identify the protocol's structure.
   • BScan the device's open ports to identify services running on it.
   • CExtract the firmware from the device's flash memory using a hardware programmer.
   • DSearch online for known vulnerabilities in the device's model.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A penetration testing firm is contracted to assess a power utility's OT environment. The utility has a strict policy that no active scanning or exploitation may be performed on production systems. However, the utility wants to test the effectiveness of its security monitoring. Which testing approach best satisfies the client's constraint while still providing meaningful security insights?

   • AReview firewall logs and SIEM alerts for signs of past intrusions
   • BUse a vulnerability scanner in safe mode to avoid disruption
   • CConduct a social engineering campaign against OT operators to test human defenses
   • DPerform passive network monitoring to identify unencrypted protocols and unusual traffic patterns
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A penetration tester is assessing a smart camera that uses an MQTT broker for telemetry. The tester wants to analyze the device's firmware for hardcoded secrets and insecure configurations. Which technique is the most appropriate for this task?

   • AExtract the firmware image and run strings and binwalk to identify embedded credentials and configuration files
   • BAttempt to connect to the MQTT broker with default credentials
   • CPort scan the device to identify open services
   • DIntercept MQTT traffic to observe the topics and payloads
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   In an ICS architecture, which component is a specialized computer that controls industrial processes based on inputs from sensors?

   • ASupervisory Control and Data Acquisition (SCADA) server
   • BHuman-Machine Interface (HMI)
   • CProgrammable Logic Controller (PLC)
   • DRemote Terminal Unit (RTU)
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A penetration testing firm is hired to assess a water treatment facility's OT network. The facility uses legacy PLCs that are critical to the treatment process. The test must not cause any disruption to the water supply. Which approach is most appropriate?

   • AUse active scanning tools to identify open ports and services on the PLCs.
   • BPerform a social engineering test on the facility's operators to assess human factors.
   • CConduct a full penetration test during a planned maintenance shutdown.
   • DPerform passive monitoring of network traffic and review configuration files without sending any packets to the PLCs.
   Reveal Solution Discussion Select an answer first