ICS/SCADA Vulnerabilities ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A municipal water utility uses a radio-based SCADA system for remote well sites. The protocol is unencrypted and lacks authentication. An attacker could potentially inject false telemetry or control commands. Which mitigation is most appropriate given the constraint that the radio infrastructure cannot be replaced?

   • AIncrease the radio transmission power to improve signal strength and reduce interference.
   • BImplement frequency hopping spread spectrum to make it harder for attackers to intercept the signal.
   • CDeploy an application-layer gateway that authenticates and encrypts SCADA traffic over the radio links.
   • DDisable remote control and require operators to physically visit each well site for all changes.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hospital's HVAC control system has two vulnerabilities: (1) a remote code execution in the building management system (BMS) server, and (2) a denial-of-service vulnerability in the chiller plant controller that could cause the chiller to shut down. The hospital has a backup chiller that can be manually started. Which vulnerability should be prioritized?

   • ANeither, because the hospital has backup systems.
   • BBoth equally, because both affect availability.
   • CThe chiller plant controller DoS, because it directly affects cooling availability.
   • DThe BMS server remote code execution, because it could allow an attacker to take full control of the entire HVAC system.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security consultant reviews a SCADA network and finds that the engineering workstation has a shared administrator account with a default password. The workstation is also used for routine internet browsing by engineers. Which vulnerability is most directly exposed by this configuration?

   • AThe PLCs are not patched.
   • BThe workstation's antivirus is outdated.
   • CAn attacker could use the default credentials to gain full control of the workstation and then pivot to the control network.
   • DThe control network is not segmented from the corporate network.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A water treatment facility uses Modbus TCP between a PLC and an HMI. A security assessment reveals that the PLC accepts writes from any host on the control network without authentication. The facility cannot schedule a shutdown for a firmware update for another three months. What is the most appropriate immediate mitigation?

   • AChange the PLC's IP address to a non-routable private address.
   • BDisable the Modbus TCP service on the PLC until the firmware update can be performed.
   • CPlace a stateful firewall between the HMI and PLC that allows only the HMI's IP address to reach the PLC's Modbus port.
   • DImplement application-layer authentication on the HMI software.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A pharmaceutical plant uses a legacy serial protocol (Modbus RTU) between a PLC and a SCADA server. The protocol has no authentication, and a risk assessment shows that an attacker with access to the serial link could alter setpoints. The plant cannot replace the PLC or the SCADA server. Which mitigation provides the best security improvement while maintaining operational reliability?

   • AInstall an inline serial firewall that filters Modbus function codes and restricts write commands to the SCADA server's address.
   • BDisable all write commands in the PLC's configuration.
   • CEncrypt the serial link using a VPN tunnel over a serial-to-Ethernet converter.
   • DAdd a second SCADA server for redundancy.
   Reveal Solution Discussion Select an answer first