Attack Methodologies in ICS ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant has a flat network where the corporate IT and ICS networks are not segmented. An attacker who compromises an IT workstation can directly reach the PLCs. Which attack vector is most directly enabled by this network architecture?

   • APhysical attack vector
   • BNetwork-based attack vector
   • CHuman attack vector
   • DSupply chain attack vector
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is analyzing a sophisticated attack on a natural gas pipeline. The attack began with a phishing email to an engineer, then used stolen VPN credentials to access the ICS network. Once inside, the attacker used a MITM attack to alter pressure readings displayed on the HMI while sending different commands to the PLC, causing overpressure. Which phase of the attack lifecycle does the MITM attack represent?

   • AImpact
   • BLateral movement
   • CActions on objective
   • DInitial compromise
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A utility company is evaluating risk. They have a legacy serial-based RTU that is physically accessible in an unsecured cabinet. They also have a modern IP-based RTU with strong authentication but connected to a shared network. Which RTU poses a higher risk of a successful attack?

   • ANeither is risky because the threats are not specified
   • BThe modern IP RTU, because it is connected to a shared network
   • CBoth are equally risky because each has a single vulnerability
   • DThe legacy serial RTU, because physical access allows direct manipulation
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security assessment of a power substation identifies that the serial communication between a remote terminal unit (RTU) and the master station uses a proprietary protocol with no authentication. An attacker with temporary physical access to the serial line could inject false data. Which ICS attack surface is being exploited?

   • AField devices
   • BCommunication protocols
   • CHuman-machine interface (HMI)
   • DControllers
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A chemical plant's safety system is connected to the corporate network for reporting. An attacker uses a USB drive dropped in the parking lot to infect an operator's workstation, which then spreads to the safety system. Which attack vectors are being combined?

   • AHuman and physical
   • BPhysical and human
   • CNetwork and supply chain
   • DPhysical and network
   Reveal Solution Discussion Select an answer first