IoT and OT Attacks and Countermeasures EHE Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   A hospital deploys IoT infusion pumps that connect to the network. The pumps run an outdated firmware with known vulnerabilities, and the vendor is slow to release patches. The security team wants to reduce the risk of a ransomware attack spreading from the pumps to the rest of the network. Which control is most effective in this situation?

   • AWait for the vendor to release a patch and do nothing else.
   • BSegment the infusion pumps onto a dedicated network with strict access control lists and monitor traffic for anomalies.
   • CInstall third-party antivirus software on the pumps.
   • DDisconnect the pumps from the network and rely on manual data entry.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which OT attack type is most commonly used as an initial vector to gain a foothold in an OT network by tricking an employee into opening a malicious attachment?

   • ASpear-phishing
   • BRansomware
   • CMan-in-the-middle
   • DDirect manipulation of industrial processes
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A security analyst notices that a large number of IoT devices on the corporate network are sending DNS queries to a suspicious domain. Further investigation reveals that the devices were compromised and are part of a botnet used for DDoS attacks. The analyst needs to contain the threat and prevent future recruitment. Which immediate action is most effective?

   • ADisable all IoT devices and replace them with new ones from a different vendor.
   • BBlock the suspicious domain at the DNS firewall and quarantine the affected devices from the network.
   • CChange the default passwords on all IoT devices and hope the botnet is removed.
   • DIncrease the logging level on the DNS server to capture more details about the queries.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A hospital is deploying IoT medical devices that are critical for patient care. The devices have known vulnerabilities, and the vendor provides patches but only during scheduled maintenance windows. The security team wants to minimize the risk of exploitation while ensuring device availability. Which approach best balances security and availability?

   • AApply patches during the vendor's maintenance windows and implement compensating controls such as network segmentation and monitoring in the meantime.
   • BApply patches immediately as soon as they are released, regardless of the maintenance window.
   • CDo not apply patches because they might cause device malfunction.
   • DDisconnect the devices from the network until patches are applied.
   Reveal Solution Discussion Select an answer first