Identify Vulnerabilities and Exploitation ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the most significant potential impact of exploiting a vulnerability in a safety-critical ICS/SCADA system?

   • APhysical harm to personnel or the environment
   • BFinancial loss from ransomware
   • CReputation damage to the organization
   • DLoss of intellectual property
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is investigating an incident at a manufacturing plant. The plant uses a legacy protocol that lacks authentication. The analyst finds that an attacker has been sending crafted packets to a PLC, causing it to cycle through different states rapidly. The PLC is connected to a robotic arm. What is the most likely attack technique and its primary impact?

   • ABuffer overflow; the attacker is exploiting a memory corruption bug to execute arbitrary code on the PLC
   • BReplay attack; the attacker is replaying a sequence of valid commands to cause the robotic arm to cycle
   • CMan-in-the-middle; the attacker is intercepting and modifying commands between the HMI and PLC
   • DProtocol manipulation; the attacker is sending malformed or unexpected packets to cause erratic behavior in the robotic arm
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A mining operation uses a SCADA system to control conveyor belts. The system has a known vulnerability in the OPC UA server that allows an unauthenticated attacker to read and write data. The plant manager is concerned about the potential impact. What is the most direct physical impact an attacker could have by exploiting this vulnerability?

   • AThe attacker could modify the speed setpoints of the conveyor belts, causing them to run too fast or too slow, potentially leading to equipment damage or material spillage.
   • BThe attacker could steal sensitive production data, leading to a loss of competitive advantage.
   • CThe attacker could crash the OPC UA server, causing a loss of visibility for operators.
   • DThe attacker could install ransomware on the OPC UA server, encrypting data and demanding payment.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security engineer is testing the security of a SCADA system. The engineer sends a specially crafted packet to a PLC that is designed to overflow a buffer in the PLC's network stack, causing it to execute arbitrary code. What is the most likely immediate impact of this attack?

   • AThe PLC will log the event and alert the operator, but no other impact will occur.
   • BThe PLC will ignore the packet and continue normal operation, as it is designed to handle malformed traffic.
   • CThe PLC will execute the attacker's code, potentially allowing them to modify the control logic or send false data to the HMI.
   • DThe PLC will crash and require a manual restart, causing a temporary loss of control.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A regional electrical utility is planning to upgrade its substation automation. The current system uses legacy serial DNP3, which is unauthenticated. The utility has a limited budget and must choose between two projects: (1) upgrading all RTUs to support DNP3 Secure Authentication, or (2) deploying a next-generation firewall with DNP3 inspection at each substation's network boundary. The utility's risk assessment shows that the most likely attack vector is from the corporate network via a compromised engineering workstation. Which project should the utility prioritize?

   • ADeploy the next-generation firewall with DNP3 inspection at each substation boundary, as it provides immediate protection against the identified attack vector.
   • BImplement both projects simultaneously, even if it means exceeding the budget, to ensure comprehensive security.
   • CUpgrade the RTUs to support DNP3 Secure Authentication, as it addresses the root cause of the unauthenticated protocol.
   • DFocus on improving physical security at the substations, as the most likely attack vector is physical access.
   Reveal Solution Discussion Select an answer first