How ICS/SCADA Are Targeted ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A manufacturing company discovers that a competitor has been sending spear-phishing emails to its control engineers. The emails contain links to a website that attempts to exploit a known vulnerability in the engineering workstation's browser. The company suspects the goal is to steal proprietary process recipes. Which threat actor profile best matches this activity?

   • AA cybercriminal gang looking to deploy ransomware for financial gain
   • BA state-sponsored espionage group interested in industrial secrets
   • CAn insider threat with legitimate access to the control network
   • DA hacktivist group seeking to disrupt operations for political reasons
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A chemical plant's safety system (SIS) is connected to the same network as the DCS, and both are accessible from the corporate network. An attacker who compromises the DCS could potentially disable safety interlocks. Which attack surface weakness is most critical?

   • AOutdated HMI software
   • BInsufficient logging on the firewall
   • CWeak passwords on the DCS engineering workstation
   • DLack of separation between safety and control systems
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is profiling potential attackers against a nuclear power plant. They consider a hacktivist group, a nation-state actor, and a cybercriminal gang. The team needs to prioritize defenses based on the most likely attacker with the highest potential impact. Which attacker profile should be prioritized?

   • AAll three equally, because any attacker could cause significant damage
   • BCybercriminal gang, because they are financially motivated and will target any system
   • CHacktivist group, because they are more likely to target nuclear facilities for publicity
   • DNation-state actor, because they have the resources and intent to cause strategic disruption
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst notices unusual outbound connections from a PLC to an external IP address. The PLC was recently updated with firmware from a USB drive. Which stage of the attack lifecycle is most likely occurring?

   • ACommand and control (C2) communication
   • BReconnaissance
   • CInitial delivery
   • DLateral movement
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common motivation for state-sponsored attacks on ICS/SCADA systems?

   • AEspionage to gather intelligence on industrial processes
   • BImproving the security of the target system
   • CPersonal revenge against a company
   • DFinancial gain through credit card fraud
   Reveal Solution Discussion Select an answer first