ICS/SCADA Vulnerabilities ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant uses DNP3 for communication between a master station and remote terminal units (RTUs). A security assessment finds that DNP3 traffic is unencrypted and can be spoofed. The plant cannot replace the RTUs or the master station in the near term. Which mitigation strategy is most appropriate?

   • ASwitch the protocol to IEC 61850 on the same hardware.
   • BImplement application-layer authentication in the DNP3 stack.
   • CDisable all remote access to the RTUs.
   • DDeploy a bump-in-the-wire encryption device on the serial or Ethernet links between the master and RTUs.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A natural gas pipeline operator uses a wireless mesh network to connect remote pressure sensors to a central control system. The wireless protocol is known to be susceptible to replay attacks. An attacker could replay a 'normal pressure' reading to mask an actual overpressure condition. What is the most significant consequence of this vulnerability?

   • AThe attacker could steal sensor calibration data.
   • BThe central control system would lose its configuration.
   • CThe wireless network would experience increased latency.
   • DOperators could fail to detect a dangerous overpressure event, leading to a pipeline rupture.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A water treatment facility uses legacy PLCs that communicate over Modbus TCP. The ICS network is flat and the PLCs have no authentication. Management wants to reduce the risk of unauthorized writes to the PLCs without replacing them. Which mitigation should the team implement first?

   • AReplace all legacy PLCs with modern ones that support encrypted authentication protocols.
   • BDeploy a stateful firewall between the corporate network and the ICS network, restricting Modbus TCP traffic to known source IPs and blocking unexpected function codes.
   • CDisconnect the PLCs from the network and rely on local HMI panels for all operations.
   • DEnable SNMP read-write community strings on the PLCs to allow remote monitoring and configuration.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A refinery has two vulnerabilities: (1) a buffer overflow in the HMI software that can be triggered remotely and causes the HMI to crash, and (2) a misconfigured firewall that allows external access to the historian database, which contains non-critical process data. The HMI is used for monitoring but not for safety-critical control. The historian is not directly connected to the control network. Which vulnerability should be prioritized?

   • AThe HMI buffer overflow, because it can be exploited remotely and affects availability of monitoring.
   • BNeither, because the refinery can operate without the HMI and the historian data is non-critical.
   • CBoth equally, because both are remotely exploitable.
   • DThe historian firewall misconfiguration, because it exposes data to the internet.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A cyber incident at a chemical plant involves an attacker exploiting a vulnerability in the OPC UA server to read and modify process setpoints. The plant's safety systems are independent and not affected. What is the most significant impact of this incident?

   • AThe safety systems would be disabled.
   • BThe plant would lose all historical data.
   • CThe attacker could alter setpoints to cause an unsafe chemical reaction, potentially leading to a release of hazardous materials.
   • DThe attacker could steal proprietary process recipes.
   Reveal Solution Discussion Select an answer first