Protocols, Communications, & Compromises GICSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a common vulnerability in the DNP3 protocol that an attacker can exploit to cause a denial of service or manipulate data?

   • AIt lacks encryption and has limited authentication, allowing spoofed frames to be injected into the communication stream.
   • BThe protocol uses weak pre-shared keys that are transmitted in clear text during the handshake.
   • CIt has no defined frame format, so devices accept any arbitrary byte stream as a valid message.
   • DIt uses a fixed port number that is always open on firewalls, making it easy for attackers to scan and target.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A water treatment plant has a control network that uses both Ethernet/IP and serial Modbus. The plant is planning to connect to a remote monitoring center. The security team is concerned about attackers using the monitoring connection to reach the control network. Which design is most secure?

   • AAllow the remote center to have full access to the control network for troubleshooting.
   • BUse a VPN with strong encryption for the monitoring connection.
   • CPlace the monitoring center on the same network segment as the control network.
   • DUse a unidirectional gateway to send monitoring data to the remote center.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A chemical plant uses DNP3 over TCP/IP for communication with remote field devices. The security team discovers that an attacker can send DNP3 messages that cause the master station to misinterpret data. Which mitigation is most effective while maintaining the ability to communicate with legacy field devices?

   • AReplace all legacy field devices with modern ones that support DNP3 Secure Authentication.
   • BEncrypt all DNP3 traffic with a VPN.
   • CDisable DNP3 and use Modbus TCP instead.
   • DDeploy an application-layer firewall that validates DNP3 message integrity and source addresses.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which method is commonly used to compromise an industrial communication channel by intercepting and possibly altering messages between a PLC and an HMI?

   • AMan-in-the-middle (MITM) attack using ARP spoofing on the local network
   • BDenial of service (DoS) attack that permanently destroys the PLC's firmware
   • CPhishing the HMI operator to reveal the PLC's IP address
   • DSQL injection against the PLC's database to modify ladder logic
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A manufacturing plant uses EtherNet/IP for motion control. The security team wants to prevent an attacker from sending malicious CIP messages that could cause a robot to move unexpectedly. They cannot add new hardware and cannot change the PLC program. What is the most effective control?

   • AConfigure the existing managed switches to use 802.1X port authentication
   • BIncrease the CIP connection timeout
   • CSet the PLC to ignore all CIP messages
   • DEnable IGMP snooping to reduce multicast traffic
   Reveal Solution Discussion Select an answer first