How ICS/SCADA Are Targeted ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What was a key targeting method used in the 2015 Ukraine power grid attack?

   • AUsing a USB drive dropped in a parking lot
   • BExploiting a zero-day vulnerability in a firewall
   • CSpear-phishing emails with malicious attachments
   • DPhysical intrusion into a substation
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A power utility has a legacy SCADA system that uses unencrypted DNP3 over serial links. They are planning to upgrade to TCP/IP-based DNP3. The security team must decide whether to implement encryption at the application layer or rely on network-layer encryption (IPsec). Which factor is most important in this decision?

   • AApplication-layer encryption allows for finer-grained access control and monitoring
   • BApplication-layer encryption is more compatible with legacy devices
   • CNetwork-layer encryption provides end-to-end security without requiring changes to the SCADA application
   • DNetwork-layer encryption is easier to manage and troubleshoot
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a common attack vector specifically used to target ICS/SCADA systems?

   • ADenial-of-service attack on a public e-commerce website
   • BDirect exploitation of a SQL injection vulnerability in a public web server
   • CPhysical theft of a laptop from a corporate office
   • DSpear-phishing emails sent to control-system engineers
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A pharmaceutical company's batch process controller was hit by ransomware that encrypted the recipe files and demanded payment in cryptocurrency. The company had no offline backups and paid the ransom. Which motivation best explains the attacker's behavior?

   • AState-sponsored sabotage to disrupt production
   • BIndustrial espionage to steal proprietary formulas
   • CFinancial gain through extortion
   • DHacktivism to protest pharmaceutical pricing
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an incident response, you find that the attacker first sent a malicious link to an operator, then used the operator's VPN credentials to access the OT network, then scanned for Modbus devices, and finally modified setpoints on a PLC. Which stage of the attack lifecycle does the 'scanning for Modbus devices' represent?

   • AReconnaissance and discovery
   • BInitial compromise
   • CActions on objectives
   • DDelivery and exploitation
   Reveal Solution Discussion Select an answer first