Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An attacker has gained access to a building automation system (BAS) that controls HVAC in a data center. The attacker wants to cause a denial of service by overheating the servers. The BAS uses BACnet/IP on UDP port 47808. The attacker has a foothold on a workstation in the same subnet. Which action is most likely to achieve the goal?

   • AUse ARP spoofing to intercept and modify BACnet traffic between the controller and sensors.
   • BDelete the BACnet configuration file on the BAS controller.
   • CFlood the BAS controller with BACnet traffic to cause it to crash.
   • DSend a BACnet WriteProperty request to set the temperature setpoint to a very high value.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A security analyst is monitoring an OT network and notices unusual traffic patterns. The analyst suspects an attacker is performing enumeration. Which observation is most indicative of active enumeration?

   • AA single DNS query to an external domain from the engineering workstation.
   • BAn increase in email traffic to the plant's administrative staff.
   • CA series of TCP connection attempts to port 502 on multiple IP addresses in the OT subnet.
   • DA broadcast ARP request from a PLC to all devices.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A penetration tester is assessing a hydroelectric dam's SCADA system. The tester has been given access to the corporate IT network but not the OT network. The goal is to identify the OT network's IP address range and the types of devices connected. The tester must avoid any action that could alert the OT security team. Which approach is most effective?

   • APerform a ping sweep of the IT network to find OT gateways.
   • BUse social engineering to trick an OT engineer into revealing the network diagram.
   • CRun a vulnerability scan against the IT network to find a pivot point into the OT network.
   • DUse passive DNS and NetFlow data from the IT network to identify OT IP ranges and device types.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   After compromising an ICS network, an attacker wants to maintain access even if the engineering workstation is rebooted. The attacker has administrator privileges on the workstation. Which technique is most effective for persistence?

   • AModify the HMI application's configuration to store credentials in plaintext.
   • BCreate a new local user account and add it to the Administrators group.
   • CInstall a service that runs automatically at startup and connects back to a command-and-control server.
   • DDelete the Windows event logs to hide the initial intrusion.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An attacker has identified that a remote terminal unit (RTU) in a pipeline uses a proprietary protocol with a hardcoded backdoor account. The attacker wants to gain control of the RTU without triggering alarms. Which exploitation technique is most aligned with this scenario?

   • APerform a denial-of-service attack by flooding the RTU with traffic.
   • BIntercept and replay legitimate commands to the RTU.
   • CScan the RTU for open ports to find other services.
   • DUse the hardcoded credentials to log in and change the RTU's configuration.
   Reveal Solution Discussion Select an answer first