IoT and OT Attacks and Countermeasures EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A smart building management system uses IoT sensors to control HVAC and lighting. The sensors communicate with a central controller via a wireless protocol that is not encrypted. An attacker with a radio transceiver can capture and replay sensor readings to manipulate the system. Which attack vector is being exploited?

   • AInsecure communication channel
   • BFirmware vulnerability in the sensors
   • CInsecure web interface on the controller
   • DWeak authentication on the central controller
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing plant's OT network was hit by ransomware that encrypted the engineering workstations. The plant manager wants to restore operations quickly. The backup strategy includes nightly backups of the engineering workstations but not the PLC configurations. What is the most important lesson from this incident?

   • AThe engineering workstations should have been air-gapped from the OT network.
   • BRansomware only affects IT systems, not OT systems.
   • CThe plant should rely on the vendor to restore the PLC configurations.
   • DOT environments need comprehensive backup and recovery plans that include device configurations and logic.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital deploys IoT infusion pumps that communicate with a central monitoring system. The pumps have a web interface for configuration that is accessible from the hospital's general IT network. The security team wants to reduce the risk of an attacker tampering with pump settings. Which control would be most effective?

   • APlace the pumps on a separate VLAN with strict access control lists
   • BDisable the web interface on all pumps and rely on physical access for configuration
   • CImplement a strong password policy for the web interface
   • DMonitor the pumps' network traffic for anomalies
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which OT security countermeasure is most effective in detecting anomalous behavior on an industrial control network, such as unexpected Modbus commands?

   • AIncident response planning
   • BNetwork monitoring
   • CPatch management
   • DAccess control
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A regional electricity utility is modernizing its OT environment. The utility must maintain 99.99% availability for its grid control systems. The security team proposes two initiatives: (1) deploying an inline intrusion prevention system (IPS) that can drop malicious packets, and (2) implementing a security information and event management (SIEM) system that collects logs from all OT devices. The utility's risk assessment shows that the most likely attack is a spear-phishing campaign targeting engineers. Which initiative should be prioritized?

   • APrioritize employee security awareness training over both initiatives
   • BDeploy the SIEM first, because it provides visibility without risking availability
   • CDeploy the IPS first, because it can actively block attacks
   • DDeploy both simultaneously to maximize security
   Reveal Solution Discussion Select an answer first