Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   After compromising a SCADA server, an attacker wants to ensure that the compromise is not discovered by the security operations center (SOC). Which action is most directly related to covering tracks?

   • ADisable the Windows Event Log service and delete relevant log files.
   • BCreate a scheduled task to run a reverse shell every hour.
   • CEnumerate all users with administrative privileges.
   • DInstall a new driver for the network card.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security consultant is performing a red team exercise for a regional electrical grid operator. The rules of engagement allow passive reconnaissance only for the first week. Which activity is permissible during this period?

   • AConnecting to the HMI's web interface to check the version.
   • BUsing a vulnerability scanner to identify missing patches on the SCADA servers.
   • CReviewing the operator's public procurement documents to identify the make and model of their RTUs.
   • DRunning a ping sweep against the OT network to identify live hosts.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A penetration tester is planning an assessment of a wastewater treatment plant. The client wants to know which systems are most vulnerable to remote exploitation. The tester has already completed passive reconnaissance and identified the HMI software version. What should the tester do next in the hacking methodology?

   • AImmediately attempt to exploit the HMI software using known exploits.
   • BEstablish persistence by installing a backdoor on the HMI server.
   • CScan the OT network to identify live hosts and open ports, then enumerate services and versions.
   • DCover tracks by clearing logs on the HMI server.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An attacker has gained a foothold on a Windows-based HMI in a manufacturing plant. The attacker wants to move laterally to a PLC that uses an unauthenticated Modbus TCP service. Which action is most directly aligned with the exploitation phase?

   • ARun a password-spraying attack against the PLC's web configuration page.
   • BInstall a keylogger on the HMI to capture credentials for the engineering workstation.
   • CUse a Metasploit module to exploit a known RCE vulnerability in the HMI's web interface.
   • DCraft a Modbus TCP packet that writes to a coil register on the PLC to change a physical output.
   Reveal Solution Discussion Select an answer first