Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An attacker has identified that a certain model of PLC has a default password for its maintenance account. The PLC is accessible from the corporate network. What is the most likely next step in the exploitation phase?

   • APerform a denial-of-service attack by flooding the PLC with traffic.
   • BDelete the PLC's event logs to hide the attack.
   • CScan the PLC for open ports to confirm it is alive.
   • DLog in with the default credentials and upload a malicious program to the PLC.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is reviewing a cyber incident at a natural gas pipeline. The investigation reveals that the attacker first gathered information from public sources, then scanned the OT network, exploited a vulnerability in a historian server, and finally deleted logs and disabled alarms. Which phase of the hacking process is the attacker in when they disable alarms?

   • ACovering tracks
   • BMaintaining access
   • CExploitation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an assessment of a water utility, you have discovered a device that responds to Modbus TCP on port 502. You need to enumerate the device's register map to understand what processes it controls. Which tool or technique is most appropriate?

   • AAttempt to upload a new firmware to the device.
   • BUse the Modbus function code 0x01 (Read Coils) to read the coil states.
   • CUse a vulnerability scanner to check for CVE-2019-xxxx.
   • DRun a full Nmap port scan on the device to find additional services.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A threat actor has successfully compromised a SCADA system and achieved their objective of disrupting operations. They now want to avoid attribution. Which combination of actions best achieves this?

   • ADelete event logs, disable auditing, and overwrite free disk space on the compromised hosts.
   • BChange all passwords on the compromised systems to new values.
   • CInstall a backdoor for future access and then leave the system running.
   • DSend a broadcast message to all users apologizing for the disruption.
   Reveal Solution Discussion Select an answer first
6. 35expert · medium

   A red team is planning an attack on a nuclear power plant's control system. The team has limited time and wants to maximize the impact of a single attack. Which phase of the hacking methodology should they focus on to achieve the most significant disruption?

   • ACovering tracks, by deleting logs after the attack.
   • BExploitation, by targeting a vulnerability in the safety system's PLC to cause a false trip.
   • CScanning, by mapping the entire OT network.
   • DReconnaissance, by gathering more information about the plant's personnel.
   Reveal Solution Discussion Select an answer first