An oil refinery's OT network has been operating for decades with legacy systems. The company wants to improve security but has a limited budget. The most critical risk is a ransomware attack that could halt production. Which investment provides the best risk reduction for the budget?

Implement network segmentation and offline backups of critical OT configurations.

Purchase a commercial threat intelligence feed.

Hire additional security staff.

Upgrade all legacy systems to modern ones.

A logistics company uses IoT trackers on shipping containers. The trackers send location data over a cellular network using a proprietary protocol. The company is expanding to a region with strict data residency regulations. The trackers currently send data to a cloud server in another country. The company must comply with the regulation while maintaining real-time tracking. What is the best approach?

Stop tracking shipments in that region to avoid the regulation.

Continue using the existing cloud server and encrypt the data in transit.

Deploy a local gateway in the region that collects data and forwards it to a regional cloud server that complies with data residency.

Store data on the trackers and upload it only when the containers return to the home country.

A smart building management system uses IoT controllers that communicate over Wi-Fi. The controllers have a web interface with a default admin password. An attacker could potentially access the controllers and manipulate the HVAC system. What is the most direct attack vector in this scenario?

The default admin password on the web interface.

The controllers do not have a firewall.

The Wi-Fi network is unencrypted.

The HVAC system is not connected to the internet.

Which IoT device component is most commonly targeted by attackers to intercept data transmitted between the device and a cloud service?

The communication interface (e.g., Wi-Fi, Bluetooth, Zigbee)

The user interface (e.g., mobile app)

A natural gas pipeline operator uses a control system that has been in operation for 20 years. The system uses a proprietary protocol that is not well-documented, and the vendor is no longer in business. The operator wants to improve security but has limited budget. Which approach is most cost-effective?

Replace the entire control system with a modern solution

Reverse-engineer the proprietary protocol to identify vulnerabilities

Deploy network monitoring to gain visibility into the control network

Disconnect the control system from the network and use manual operations

EC-CouncilEthical Hacking Essentials

Domain 7Objective 5

IoT and OT Attacks and Countermeasures EHE Practice Questions (Page 8)

Part of the Wireless, Mobile, IoT, and OT Attacks domain, which makes up ~15% of our current practice bank.

54questions here

11free pages

8concepts

Questions 36–40

36expert · hard
An oil refinery's OT network has been operating for decades with legacy systems. The company wants to improve security but has a limited budget. The most critical risk is a ransomware attack that could halt production. Which investment provides the best risk reduction for the budget?
Select an answer first
37expert · hard
A logistics company uses IoT trackers on shipping containers. The trackers send location data over a cellular network using a proprietary protocol. The company is expanding to a region with strict data residency regulations. The trackers currently send data to a cloud server in another country. The company must comply with the regulation while maintaining real-time tracking. What is the best approach?
Select an answer first
38application · medium
A smart building management system uses IoT controllers that communicate over Wi-Fi. The controllers have a web interface with a default admin password. An attacker could potentially access the controllers and manipulate the HVAC system. What is the most direct attack vector in this scenario?
Select an answer first
39foundation · easy
Which IoT device component is most commonly targeted by attackers to intercept data transmitted between the device and a cloud service?
Select an answer first
40application · medium
A natural gas pipeline operator uses a control system that has been in operation for 20 years. The system uses a proprietary protocol that is not well-documented, and the vendor is no longer in business. The operator wants to improve security but has limited budget. Which approach is most cost-effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

IoT and OT Attacks and Countermeasures EHE Practice Questions (Page 8)

Questions 36–40

An oil refinery's OT network has been operating for decades with legacy systems. The company wants to improve security but has a limited budget. The most critical risk is a ransomware attack that could halt production. Which investment provides the best risk reduction for the budget?

A smart building management system uses IoT controllers that communicate over Wi-Fi. The controllers have a web interface with a default admin password. An attacker could potentially access the controllers and manipulate the HVAC system. What is the most direct attack vector in this scenario?

Which IoT device component is most commonly targeted by attackers to intercept data transmitted between the device and a cloud service?

Keep studying — Wireless, Mobile, IoT, and OT Attacks