Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A mobile security team is testing a banking app that uses certificate pinning. The team wants to perform dynamic analysis to intercept and modify the app's HTTPS traffic. The app is running on a non-rooted Android device. Which approach is most likely to succeed?

   • APerform static analysis of the APK to extract the pinned certificate and then impersonate the server
   • BUse Frida to hook the app's certificate validation functions and bypass pinning, then route traffic through a proxy
   • CUse a rooted device to replace the system CA store and then intercept traffic
   • DInstall a custom CA certificate on the device and use a proxy, hoping the app trusts it
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a known security weakness of the Android platform compared to iOS?

   • ANo encryption support
   • BLack of app sandboxing
   • CFragmentation due to multiple device manufacturers and custom UI layers
   • DNo permission system
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A penetration tester is planning a test on a live chemical plant's OT network. The plant cannot tolerate any interruption to the production process. Which testing approach best balances the need for security assessment with the plant's operational constraints?

   • APerform active exploitation of vulnerabilities on the live PLCs to confirm impact
   • BRun a full vulnerability scanner with aggressive plugins on the OT network
   • CDisconnect the OT network from the IT network to test in isolation
   • DUse passive monitoring and review of configurations and network traffic without sending disruptive packets
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a unique security challenge in OT environments compared to traditional IT?

   • AConfidentiality is the highest priority
   • BSystems are typically patched monthly
   • CAvailability is prioritized over confidentiality
   • DSecurity updates are applied automatically
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A penetration tester is asked to assess the security of a remote oil pumping station that is connected to the central SCADA system via a satellite link. The station has limited bandwidth and the pumping process cannot be interrupted. The tester wants to test the SCADA protocol for vulnerabilities. Which approach is most appropriate given the constraints?

   • ASend crafted SCADA packets to the station to test for protocol weaknesses
   • BDisconnect the satellite link and test the station locally
   • CRun a full vulnerability scan over the satellite link to identify open ports and services
   • DPerform a passive analysis of the SCADA traffic to identify protocol anomalies and insecure settings
   Reveal Solution Discussion Select an answer first