PERA Level 0 & 1 Technology Overview and Compromise GICSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A natural gas pipeline uses RTUs to monitor and control compressor stations. The RTUs communicate with the SCADA master over a satellite link. An attacker has gained access to the RTU's firmware and can modify the RTU's logic. The attacker wants to cause a compressor to overspeed, leading to a failure. Which of the following modifications would be most effective and stealthy?

   • AChange the compressor speed setpoint to a higher value and disable the overspeed alarm.
   • BModify the speed sensor scaling so that the RTU reads a lower speed than actual.
   • CDisable the emergency shutdown logic in the RTU.
   • DChange the compressor's speed feedback signal to a fixed value.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing plant has a limit switch on a robotic arm that signals when the arm is in its home position. The switch is wired to a PLC input. The PLC uses this input to start the next cycle. An attacker has physically tampered with the switch so that it always sends the 'home' signal. What is the MOST likely consequence?

   • AThe PLC will stop the arm and require a manual reset.
   • BThe PLC will ignore the switch and continue the cycle normally.
   • CThe robotic arm may start a cycle before it is actually in the home position, causing a collision.
   • DThe arm will move to the home position and stay there.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A chemical plant uses a PLC to control a batch process. The PLC communicates with a remote I/O rack over a fiber optic ring. The ring is configured with a redundant path. An attacker cuts the fiber in one location. What is the MOST likely impact on the process?

   • AThe process continues without interruption because the ring reconfigures.
   • BThe PLC switches to a backup controller.
   • CThe process continues but with reduced accuracy.
   • DThe process shuts down because the remote I/O is lost.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A chemical plant's Level 1 DCS controller is receiving unexpected high-pressure readings from a Level 0 pressure transmitter. The process is currently within safe limits, but the operator sees alarms and the controller has started closing a control valve. The safety instrumented system (SIS) has not activated. Which of the following is the MOST likely explanation for this behavior?

   • AThe control valve's positioner has been reversed, so the controller's close command actually opens the valve.
   • BAn attacker has compromised the DCS controller and is manipulating the setpoint to cause a valve closure.
   • CThe SIS has been bypassed, so the controller is now responsible for safety actions.
   • DThe pressure transmitter's 4-20 mA loop has been tampered with, causing the controller to read a higher pressure than the actual process.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A pharmaceutical plant has a PLC that controls a reactor's temperature by adjusting a cooling water valve. The PLC also sends temperature data to a historian at Level 3. An attacker has compromised the historian and can modify historical data. Which of the following is the MOST significant security impact of this compromise?

   • AThe attacker can delete the PLC's program from the historian.
   • BThe attacker can alter batch records, leading to regulatory non-compliance.
   • CThe attacker can send commands to the PLC through the historian.
   • DThe attacker can cause the PLC to overheat the reactor by changing the historian's setpoints.
   Reveal Solution Discussion Select an answer first