Identify Vulnerabilities and Exploitation ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant uses a legacy Windows 7-based HMI that is no longer supported by the vendor. The HMI is connected to the OT network and is required for daily operations. The plant has a strict change-management policy that prohibits installing any new software on the HMI without a lengthy approval process. What is the most practical immediate step to reduce the risk from known unpatched vulnerabilities in the HMI?

   • AInstall a third-party patch management tool to apply unofficial patches to the HMI.
   • BReplace the HMI with a new model that is currently supported by the vendor.
   • CDisconnect the HMI from the network and use a local console only.
   • DIsolate the HMI on a separate VLAN with strict firewall rules that only allow necessary OT protocols to and from the PLCs.
   Reveal Solution Discussion Select an answer first
2. 27application · hard

   A power utility's substation automation system uses DNP3 protocol. A recent security assessment found that the system is vulnerable to replay attacks because it does not use secure authentication. The utility cannot upgrade the RTUs and IEDs in the near term. Which mitigation strategy would be most effective in the short term to reduce the risk of replay attacks?

   • ADeploy an inline DNP3 deep-packet-inspection firewall that can detect and drop replayed messages by tracking sequence numbers and timestamps.
   • BDisable all DNP3 communication and rely on manual operator commands.
   • CIncrease the frequency of DNP3 link-layer retries to ensure messages are not lost.
   • DImplement network-level access control lists (ACLs) on the substation router to restrict DNP3 traffic to known master station IP addresses.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A chemical plant's DCS has a known vulnerability in the OPC server that allows an unauthenticated attacker to write arbitrary values to process tags. The plant safety system is independent, but the DCS controls the reactor temperature. What is the most significant potential impact of exploiting this vulnerability?

   • AThe attacker could steal confidential process recipes from the OPC server database
   • BThe plant's safety system would be bypassed, causing all safety interlocks to fail
   • CAn attacker could manipulate reactor temperature setpoints, leading to a runaway reaction and potential release of hazardous materials
   • DThe OPC server would crash, causing a temporary loss of monitoring data
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which exploitation technique involves inserting malicious code into a field that is later used as a command by the system?

   • ADenial of service
   • BBuffer overflow
   • CCommand injection
   • DMan-in-the-middle attack
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A water treatment facility uses legacy PLCs that communicate over unauthenticated Modbus TCP on a flat OT network. The engineering team has been asked to reduce the risk of an attacker sending unauthorized write commands to the PLCs, but they cannot replace the PLCs or change the protocol due to operational constraints. Which mitigation should the team implement first?

   • AImplement MAC address filtering on the managed switches so only the HMI's MAC address can communicate with the PLCs.
   • BInstall antivirus software on the engineering workstations that are used to program the PLCs.
   • CDeploy a stateful firewall between the OT network and the corporate IT network, allowing only Modbus TCP traffic from the HMI subnet to the PLC subnet.
   • DSegment the OT network into zones and enforce allow-listing of Modbus function codes at the zone boundaries using an industrial firewall or deep-packet-inspection gateway.
   Reveal Solution Discussion Select an answer first