IoT and OT Attacks and Countermeasures EHE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A smart city project deploys IoT sensors for traffic management. The sensors are connected to a central platform via a mesh network. The sensors have limited processing power and battery life. The security team wants to implement end-to-end encryption, but the sensors cannot handle the computational overhead. What is the best approach?

   • AUse a VPN tunnel from each sensor to the central platform.
   • BReplace all sensors with more powerful models that support standard encryption.
   • CDo not encrypt the sensor data because the sensors are too constrained.
   • DUse lightweight encryption algorithms designed for constrained devices and implement secure key management at the gateway.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A food processing plant wants to develop an incident response plan for OT. The plant has a mix of legacy and modern systems. What is the most important consideration for the plan?

   • AThe plan must account for the potential physical impact of OT incidents and the need for safe shutdown procedures.
   • BThe plan should focus only on IT systems because OT systems are not at risk.
   • CThe plan should be the same as the IT incident response plan.
   • DThe plan should rely on the vendor for all response actions.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A food processing plant has a mix of modern and legacy OT systems. The legacy systems are critical to production and cannot be taken offline for patching. The plant has experienced a series of targeted phishing emails that could lead to malware infections. The security team must choose a strategy that minimizes the risk of a production outage while addressing the phishing threat. Which strategy is most appropriate?

   • AApply virtual patches to the legacy systems using an intrusion prevention system
   • BIncrease the frequency of backups to reduce the impact of a ransomware attack
   • CSegment the legacy systems into a separate network and implement strict access controls
   • DShut down the legacy systems during non-production hours to apply patches
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A cyber incident at a nuclear power plant involved a spear-phishing email that led to the compromise of a contractor's laptop. The laptop was used to remotely access the plant's OT network. The plant has a security policy that prohibits remote access to OT, but the contractor needed it for troubleshooting. What is the most effective way to prevent similar incidents?

   • ARely on the contractor's antivirus software to prevent malware.
   • BProvide the contractor with a dedicated, hardened laptop that is only used for OT access.
   • CEnforce strict access control with multi-factor authentication and limit remote access to specific, approved times and systems.
   • DBan all remote access to OT systems permanently.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company discovers that a batch of IoT devices was shipped with a backdoor account that cannot be removed via firmware updates. The devices are already deployed in the field. The company wants to minimize the risk of exploitation. Which action is most effective?

   • ADisable the devices until the vendor provides a fix.
   • BRely on the vendor's promise to fix the issue in a future firmware update.
   • CChange the backdoor account password to a strong value.
   • DIsolate the affected devices on a separate network and monitor for any traffic to known malicious IP addresses.
   Reveal Solution Discussion Select an answer first