Attack Methodologies in ICS ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   The 2010 Stuxnet attack is a well-known ICS/SCADA case study. Which of the following best describes a key methodology used in that attack?

   • AMan-in-the-middle attack on the HMI
   • BModification of PLC logic and hiding changes from the HMI
   • CReplay attack on Modbus commands
   • DDenial-of-service attack on the control network
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security consultant is assessing a pipeline control system. She identifies that the HMI software has a known vulnerability that allows remote code execution, and that the engineering workstation uses default credentials. Which attack surfaces are most directly exposed?

   • AHMI and human factors
   • BControllers and communication protocols
   • CHMI and controllers
   • DCommunication protocols and field devices
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A food processing plant has a wireless network for temperature sensors. An attacker sits in the parking lot and captures the wireless traffic, then replays it to spoof a sensor reading. Which attack vector is being used?

   • ANetwork vector via wireless interception
   • BHuman vector via social engineering
   • CPhysical vector via sensor tampering
   • DPhysical vector via parking lot access
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an incident response review, a security analyst discovers that an attacker first gained access to the corporate IT network, then pivoted to the ICS DMZ, and finally reached the HMI network. The attacker used a spear-phishing email to obtain initial credentials. Which phase of the ICS attack lifecycle does the spear-phishing email represent?

   • ALateral movement
   • BImpact
   • CReconnaissance
   • DInitial compromise
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is analyzing the 2015 Ukraine power grid attack. They note that the attackers used spear-phishing to gain access to the corporate network, then used VPN credentials to reach the ICS network, and finally issued remote commands to open breakers. Which combination of attack methodologies and lifecycle phases does this case study illustrate?

   • AReconnaissance via phishing, initial compromise via VPN, and lateral movement via remote commands
   • BInitial compromise via VPN, lateral movement via phishing, and impact via breaker commands
   • CReconnaissance via VPN, initial compromise via remote commands, and impact via phishing
   • DInitial compromise via phishing, lateral movement via VPN, and impact via remote commands
   Reveal Solution Discussion Select an answer first