How ICS/SCADA Are Targeted ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security team is reviewing the 2015 Ukrainian power grid attack to improve their own defenses. They note that the attackers gained access via phishing, then used VPN credentials to reach the SCADA network, and then used a remote access tool to open breakers. Which defense would have been most effective in preventing the final breaker operation?

   • ADisabling the HMI's screensaver
   • BImplementing application allowlisting on SCADA workstations
   • CTraining employees to recognize phishing emails
   • DUsing stronger VPN encryption
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which type of threat actor is most likely to conduct a politically motivated attack on an ICS/SCADA system?

   • AHacktivists
   • BScript kiddies
   • CInsider threats
   • DNation-state actors
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An incident responder is analyzing a cyberattack on a manufacturing plant. The attacker first compromised a vendor's remote access account, then used that access to move laterally to the engineering workstation, and then reprogrammed a PLC to cause physical damage. The plant has no network segmentation and no monitoring on the OT network. Which improvement would have been most effective in detecting the attack at an earlier stage?

   • AConducting regular security awareness training for employees
   • BSegmenting the OT network from the IT network
   • CDeploying OT-specific network monitoring to detect anomalous Modbus commands
   • DImplementing multi-factor authentication on the vendor VPN
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A municipal water treatment plant has a control system that is not connected to the internet. However, a vendor technician recently plugged a laptop into the OT network to perform maintenance. The laptop had been used on other customer sites. Which attack vector is most likely to be exploited?

   • ADirect internet attack on the control system
   • BMalicious software introduced via the vendor's laptop
   • CWireless attack from a nearby building
   • DSocial engineering of plant operators via email
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security consultant is studying the Stuxnet attack to advise a nuclear facility. The consultant notes that Stuxnet spread via USB drives and then modified the speed of centrifuges while reporting normal readings. Which attack vector and lifecycle stage are most relevant to this case?

   • AUSB drive as the delivery vector and manipulation of process values as the final objective
   • BRemote exploit as the delivery vector and ransomware as the final objective
   • CInsider access as the delivery vector and physical destruction as the final objective
   • DPhishing email as the delivery vector and data exfiltration as the final objective
   Reveal Solution Discussion Select an answer first