PERA Level 2 & 3 Technology Overview and Compromise GICSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An attacker has compromised a Level 3 MES and is sending false production orders to a Level 2 SCADA system. The SCADA system is executing these orders, causing physical equipment to operate outside safe parameters. What is the most critical impact of this compromise?

   • ALoss of historical production data
   • BThe SCADA system will automatically shut down
   • CPotential safety incident for personnel and equipment due to unsafe operating conditions
   • DIncreased network traffic on the control network
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A pharmaceutical plant uses a Level 3 historian to store batch records for regulatory compliance. The historian is connected to the corporate network for reporting. A ransomware attack encrypts the historian's database. What is the most significant consequence for the plant?

   • ALoss of access to batch records may delay regulatory audits and production release.
   • BThe control system will immediately shut down because it relies on the historian for real-time data.
   • CThe plant will be unable to operate the PLCs because they need the historian's clock.
   • DThe plant will lose the ability to monitor process variables on the HMI.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A plant's Level 3 historian is being decommissioned. The plant must retain historical data for regulatory compliance. What is the best action?

   • ADelete the data to free up space
   • BArchive the historian's database to a secure, offline storage location before decommissioning
   • CLeave the historian running but disconnected from the network
   • DMove the data to the HMI's local storage
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A power generation facility has a Level 2 HMI that is used to control turbine speed. The HMI is connected to the corporate network for remote monitoring. An attacker exploits a vulnerability in the HMI's web interface and gains control. What is the most likely immediate action the attacker will take?

   • ADisable the firewall between Level 2 and Level 3.
   • BDelete the historian's log files to cover tracks.
   • CInstall ransomware on the corporate file server.
   • DChange the turbine speed setpoint to an unsafe value.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A pharmaceutical plant's Level 3 MES is integrated with a laboratory information management system (LIMS) for quality data. The integration uses a web service that is accessible from the IT network. A penetration test reveals that the web service is vulnerable to SQL injection. What is the best remediation?

   • APlace the web service behind a firewall and restrict access to the IT network.
   • BFix the SQL injection vulnerability in the web service code and implement input validation.
   • CUse a VPN for all LIMS-to-MES communication.
   • DDisable the web service and use manual data entry.
   Reveal Solution Discussion Select an answer first