Attack Methodologies in ICS ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is comparing the 2015 Ukraine power grid attack and the 2010 Stuxnet attack. The analyst notes that both attacks involved multiple phases and methodologies. Which of the following is a key difference in the attack methodologies used?

   • AUkraine used a MITM attack, while Stuxnet used a replay attack.
   • BUkraine used remote commands to cause impact, while Stuxnet used a MITM attack to alter PLC communications.
   • CUkraine used a physical attack, while Stuxnet used a network attack.
   • DUkraine used a DoS attack, while Stuxnet used a fuzzing attack.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a forensic investigation of a compromised water treatment facility, logs show that the attacker first scanned the network for open ports, then exploited a vulnerability in a historian server, and finally used the historian as a pivot to reach the PLCs. Which attack lifecycle phases are represented?

   • AReconnaissance, weaponization, and delivery
   • BDelivery, exploitation, and installation
   • CReconnaissance, exploitation, and lateral movement
   • DExploitation, installation, and actions on objectives
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a physical attack vector against an ICS/SCADA environment?

   • AExploiting a vulnerability in the OPC server
   • BPerforming a man-in-the-middle attack on the control network
   • CMalicious USB drive left in a facility parking lot
   • DPhishing email sent to a control engineer
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security engineer is designing a defense for a legacy SCADA system that uses unauthenticated Modbus TCP. The system cannot be upgraded, and the engineer must choose a control that prevents both replay and MITM attacks on the protocol. Which control is most effective?

   • AImplement network segmentation and use a bump-in-the-wire encryption device
   • BDeploy a stateful firewall that filters Modbus function codes
   • CUse an intrusion detection system (IDS) to monitor for anomalies
   • DDisable unused Modbus function codes on the PLC
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is tasked with protecting a legacy HMI that communicates with PLCs using a protocol that lacks integrity checks. They have budget for only one control. Which control best reduces the risk of both MITM and replay attacks?

   • ASegment the network to limit access to the HMI
   • BImplement an IDS to detect anomalies in the protocol traffic
   • CDisable the HMI's remote access capability
   • DDeploy an inline security appliance that authenticates and encrypts the protocol
   Reveal Solution Discussion Select an answer first