Identify Vulnerabilities and Exploitation ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A food processing plant uses a mix of modern and legacy PLCs. The legacy PLCs are critical to the production line but cannot be patched. Which strategy best mitigates the risk of exploitation while maintaining production?

   • APlace the legacy PLCs on a separate network segment with strict firewall rules and monitor traffic for anomalies
   • BDisable all network connectivity to the legacy PLCs and rely on manual control
   • CInstall a host-based intrusion prevention system on each legacy PLC
   • DReplace all legacy PLCs with modern ones that have built-in security features
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A vulnerability scan of a wastewater treatment plant identifies that the SCADA system uses default credentials on the HMI and that the network uses unencrypted Modbus TCP. Which vulnerability is the most critical to address first?

   • ALack of network segmentation, as it allows lateral movement
   • BUnencrypted Modbus TCP, as it allows attackers to read and modify traffic
   • CDefault credentials on the HMI, as they allow direct unauthorized access to the control system
   • DOutdated HMI software, as it may have known exploits
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A regional water utility has a SCADA system with a mix of modern and legacy devices. The utility is under regulatory pressure to improve cybersecurity but has a limited budget. A recent risk assessment identified the following vulnerabilities: (1) default credentials on the HMI, (2) unencrypted Modbus TCP traffic, (3) a known buffer overflow in the legacy PLC firmware, and (4) lack of network segmentation between IT and OT. The utility cannot replace the legacy PLCs this year. Which combination of mitigations should the utility prioritize to achieve the most significant risk reduction?

   • AEncrypt all Modbus TCP traffic using a VPN and install antivirus on the HMI
   • BDisconnect the SCADA system from the corporate network and rely on manual data collection
   • CChange default credentials, segment the network with firewalls, and deploy an IDS to monitor OT traffic
   • DReplace the legacy PLCs with modern ones and disable Modbus TCP
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which mitigation strategy is most effective in preventing command injection attacks in ICS/SCADA applications?

   • AIncreasing the timeout on HMI sessions
   • BInput validation and sanitization
   • CAdding more memory to the PLC
   • DUsing longer passwords for operator accounts
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A food and beverage plant has a mix of modern and legacy PLCs. The legacy PLCs use a proprietary serial protocol that is not encrypted. The plant is planning to connect the OT network to the corporate network for better visibility. What is the most important security control to implement before making this connection?

   • ADeploy an industrial firewall with deep packet inspection at the OT/IT boundary.
   • BEnsure the OT network is segmented into zones and conduits, with the legacy PLCs in a separate zone with strict access controls.
   • CReplace all legacy PLCs with modern ones that support encryption.
   • DImplement a jump host or bastion server for all remote access to the OT network.
   Reveal Solution Discussion Select an answer first