Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security architect is designing a defense-in-depth strategy for a wastewater treatment plant. The architect wants to detect attackers who follow the hacking methodology. Which combination of controls best addresses the reconnaissance, exploitation, and persistence phases?

   • APhysical security, employee training, and incident response plans.
   • BNetwork segmentation, intrusion detection systems, and integrity monitoring.
   • CData encryption, backup systems, and disaster recovery.
   • DA strong firewall policy, antivirus software, and regular patching.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During an authorized assessment of a manufacturing plant, you are asked to identify all Ethernet/IP-enabled devices on the OT network. You have been given a list of IP ranges but no credentials. Which technique is most effective for discovering these devices and their vendor/model information?

   • AUse a UDP scan of port 502 on all IPs to identify Modbus TCP devices.
   • BRun a full TCP connect scan on all 65535 ports for each IP address.
   • CPerform an ARP scan on the local subnet and then query each responding device using the Common Industrial Protocol (CIP).
   • DSend a broadcast ping to the subnet and then use SNMP to walk the MIB on each responding host.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A threat actor has gained persistent access to a water treatment facility's SCADA system. The facility's security team is known to perform regular integrity checks on critical files. The attacker needs to maintain access without being detected by these checks. Which technique is most effective?

   • AEncrypt the backdoor binary so it appears as random data.
   • BStore the backdoor in a hidden directory with a random name.
   • CUse a rootkit to hide the backdoor process from the task manager.
   • DReplace the integrity-check tool with a version that always reports 'clean'.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A penetration tester is hired to assess the security of a municipal water treatment facility. The client has restricted the tester to passive techniques only during the first week. The tester needs to identify the ICS/SCADA vendor and potential device models without sending any packets to the target network. Which approach best satisfies the constraint?

   • AUse the Metasploit auxiliary scanner for Modbus to query the facility's SCADA servers.
   • BRun Nmap with the -sS flag against the facility's public IP ranges to identify open ports.
   • CQuery public Shodan and Censys databases for the facility's public IP ranges and search for default banners.
   • DCraft a Wireshark capture filter and sniff the facility's control network from a rogue access point.
   Reveal Solution Discussion Select an answer first
6. 45expert · medium

   A red team has gained access to a substation's RTU through a vendor backdoor. The team wants to cause a temporary disruption without being detected for as long as possible. The RTU has limited memory and no logging capability. Which action best balances the goal of disruption with stealth?

   • AUpload a new firmware that permanently disables the RTU.
   • BSend a continuous stream of invalid Modbus commands to the RTU.
   • CChange the RTU's IP address to a non-routable address.
   • DModify the RTU's control logic to open a breaker for 10 seconds and then restore normal operation.
   Reveal Solution Discussion Select an answer first