Protocols, Communications, & Compromises GICSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing plant's engineering workstation was infected with malware that scans the local network for open ports 502 and 44818. Which protocol is the malware most likely targeting?

   • AS7comm and BACnet
   • BModbus TCP and EtherNet/IP
   • CDNP3 and IEC 60870-5-104
   • DPROFINET and OPC UA
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A utility company has a legacy SCADA system using unencrypted serial protocols. They want to add remote monitoring capabilities without exposing the control network to new risks. Which approach best balances security and functionality?

   • AUse a VPN tunnel for all serial communications.
   • BConnect the serial devices directly to the internet for remote access.
   • CInstall a serial-to-Ethernet converter with a firewall that only allows outbound connections to a monitoring server.
   • DDisable remote monitoring and rely on on-site operators.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A pharmaceutical plant uses OPC UA for batch control. The security team must implement a solution that ensures only authorized clients can write to the PLC, but they also need to support a legacy HMI that only supports OPC DA. The HMI cannot be upgraded. What is the best approach?

   • AUse a firewall to block all OPC DA traffic
   • BAllow the legacy HMI to bypass security for compatibility
   • CDeploy an OPC UA gateway that translates OPC DA to OPC UA and enforces authentication and authorization
   • DReplace the legacy HMI with a new OPC UA client
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An attacker sends a flood of broadcast PROFINET DCP frames to disrupt device discovery and cause network congestion. What is the most effective mitigation?

   • AUse a hub instead of a switch to reduce latency
   • BIncrease the DCP response timeout on all devices
   • CConfigure the switches to limit broadcast traffic and enable storm control
   • DDisable DCP on all devices
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A chemical plant's control network uses DNP3 for communication with remote field devices. An incident responder finds that an attacker has been sending crafted DNP3 messages that cause the remote terminal units to report incorrect sensor readings. Which attack vector best describes this scenario?

   • APhysical theft of a remote terminal unit.
   • BProtocol fuzzing to discover and exploit parser vulnerabilities.
   • CMan-in-the-middle interception and modification of DNP3 traffic.
   • DDenial-of-service flooding of the DNP3 master station.
   Reveal Solution Discussion Select an answer first