PERA Level 2 & 3 Technology Overview and Compromise GICSP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing company's Level 3 historian server was compromised after an employee opened a phishing email on a corporate laptop that had VPN access to the plant network. The attacker then moved laterally to the historian. Which attack vector best describes this scenario?

   • AWireless attack on the control network
   • BSupply chain attack via software update
   • CIT/OT integration risk via remote access
   • DDirect physical attack on the historian
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A refinery has a Level 2 HMI that is used to monitor and control a distillation column. The HMI is compromised and the attacker changes the displayed temperature to a lower value, while the actual temperature is higher. The operator, trusting the HMI, increases the heat input. What is the most likely outcome?

   • AThe column may overheat, leading to a safety incident.
   • BThe historian will record the false temperature, but the process will be unaffected.
   • CThe safety system will shut down the column immediately.
   • DThe PLC will automatically correct the temperature.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An attacker gains access to a Level 2 supervisory control system by exploiting a weak password on an HMI's remote access service. This is an example of which type of attack vector?

   • ANetwork-based attack
   • BPhysical attack
   • CSupply chain attack
   • DSocial engineering attack
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A water treatment facility has a Level 2 HMI that is directly connected to a switch on the control network. A technician plugs a laptop into the same switch to troubleshoot a sensor. The laptop is infected with malware. What is the most immediate risk to the facility?

   • AThe malware could cause a physical explosion by directly changing PLC firmware.
   • BThe malware could spread to the HMI and alter process setpoints, affecting treatment operations.
   • CThe malware could steal credentials from the corporate domain controller.
   • DThe malware could delete historical data from the Level 3 historian.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A hospital's building automation system uses a Level 3 site server to manage HVAC for the entire facility. The server is connected to the hospital's IT network for remote access. An attacker compromises the IT network and gains access to the site server. What is the most critical impact?

   • AThe attacker can disable the fire alarm system.
   • BThe attacker can steal patient medical records from the site server.
   • CThe attacker can alter HVAC setpoints, potentially affecting patient comfort and safety.
   • DThe attacker can modify the PLC logic for the HVAC controllers.
   Reveal Solution Discussion Select an answer first