How ICS/SCADA Are Targeted ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A disgruntled former employee with knowledge of the plant's control system uses a remote access tool that was left installed on a maintenance laptop to alter a PLC program. Which threat actor type is this?

   • AInsider threat
   • BNation-state actor
   • CHacktivist
   • DCybercriminal
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a breach at a natural gas pipeline company. The attackers gained access through a phishing email, then spent months mapping the OT network and finally sent commands to increase pipeline pressure beyond safe limits. No data was stolen, and no ransom was demanded. Which motivation best explains the attackers' behavior?

   • AHacktivism to promote environmental awareness
   • BEspionage to learn pipeline operational procedures
   • CSabotage to cause physical damage or disruption
   • DFinancial gain through data theft
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security operations center (SOC) is analyzing a series of attacks against multiple ICS organizations. They notice that the attacks use similar tools and techniques, but the targets are all in the same industry. The SOC suspects a common actor. Which type of threat actor is most likely to consistently target a specific industry with sophisticated tools?

   • AA cybercriminal gang using ransomware-as-a-service
   • BA hacktivist group with a political agenda against the industry
   • CA state-sponsored advanced persistent threat (APT) group with a specific economic or strategic interest
   • DAn insider threat within one of the organizations
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a vulnerability commonly found in ICS/SCADA systems that expands the attack surface?

   • AImplementation of network segmentation
   • BRegular security audits and penetration testing
   • CUse of unpatched legacy operating systems
   • DUse of modern encryption for all communications
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional electricity distributor experiences a cyberattack that causes a multi-hour blackout. During the investigation, no ransom note is found, and no data appears to have been exfiltrated. The attack used a custom malware variant that targeted a specific model of circuit breaker. Which motivation is most likely?

   • AHacktivism to protest the company's environmental record
   • BFinancial gain through extortion
   • CPolitical or geopolitical disruption
   • DIndustrial espionage to steal customer data
   Reveal Solution Discussion Select an answer first