An attacker has compromised a human-machine interface (HMI) in a pharmaceutical plant. The attacker wants to maintain access even if the HMI is rebooted and the vulnerability is patched. Which technique is most effective for persistence?

Create a scheduled task that runs a reverse shell every time the system starts.

Disable the HMI's firewall to allow future connections.

Change the HMI's administrator password to a new value.

Delete the HMI's event logs to hide the initial compromise.

During the scanning and enumeration phase, what is the primary purpose of enumerating ICS/SCADA devices?

To identify the operating system of the engineering workstation

To map the physical layout of the facility

To identify the specific make, model, and firmware version of devices

To determine the IP address of the corporate email server

An attacker wants to identify ICS/SCADA devices on a target network. Which action is an example of active reconnaissance?

Sending a specially crafted Modbus query to a suspected PLC

Reviewing the target's job postings for required ICS certifications

Searching the target company's annual report for mentions of their SCADA vendor

Checking the target's website for contact information of OT engineers

A penetration tester is performing a red-team exercise on a mining operation's ICS. The client has set a rule: the tester must not cause any physical impact on the process. The tester has discovered a vulnerability in the HMI that allows remote code execution. Which action is most appropriate under the constraint?

Do not exploit the vulnerability; only report it as a theoretical finding.

Exploit the vulnerability and change a setpoint to prove the impact.

Exploit the vulnerability and then delete the HMI's configuration files.

Exploit the vulnerability to gain a shell, but only run read-only commands to avoid changing process values.

A penetration tester has found a buffer overflow in a PLC's web server. The PLC is critical to the plant's operation and cannot be rebooted. The tester wants to exploit the vulnerability to gain a shell. What is the primary risk the tester must consider?

The tester might lose network connectivity to the PLC.

The exploit might be detected by the plant's intrusion detection system.

The PLC's firmware might not support the shell commands needed.

The exploit could crash the PLC, causing a denial of service and disrupting plant operations.

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 1

Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 4)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 16–20

16expert · medium
An attacker has compromised a human-machine interface (HMI) in a pharmaceutical plant. The attacker wants to maintain access even if the HMI is rebooted and the vulnerability is patched. Which technique is most effective for persistence?
Select an answer first
17foundation · easy
During the scanning and enumeration phase, what is the primary purpose of enumerating ICS/SCADA devices?
Select an answer first
18foundation · easy
An attacker wants to identify ICS/SCADA devices on a target network. Which action is an example of active reconnaissance?
Select an answer first
19expert · hard
A penetration tester is performing a red-team exercise on a mining operation's ICS. The client has set a rule: the tester must not cause any physical impact on the process. The tester has discovered a vulnerability in the HMI that allows remote code execution. Which action is most appropriate under the constraint?
Select an answer first
20expert · medium
A penetration tester has found a buffer overflow in a PLC's web server. The PLC is critical to the plant's operation and cannot be rebooted. The tester wants to exploit the vulnerability to gain a shell. What is the primary risk the tester must consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.