Protocols, Communications, & Compromises GICSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An engineer notices that a remote terminal unit (RTU) occasionally reports incorrect sensor values, but the values are within the normal range. A packet capture shows that the RTU is receiving valid DNP3 frames from an unexpected IP address. What is the most likely compromise?

   • AAn attacker is injecting spoofed DNP3 frames to manipulate the reported data
   • BThe master station is sending a new configuration that changes the RTU's scaling factors
   • CThe RTU's analog input card is failing and needs replacement
   • DThe serial link is experiencing electromagnetic interference
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a typical attack vector targeting industrial communication protocols that involves sending more data than the protocol buffer can handle?

   • ADNS rebinding
   • BSession hijacking
   • CARP spoofing
   • DBuffer overflow attack
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital's building automation system uses BACnet/IP to control HVAC. An attacker on the network is able to send BACnet messages that cause the HVAC system to shut down. What is the primary impact of this communication compromise?

   • ALoss of integrity of the building's access control system.
   • BFinancial loss due to increased energy consumption.
   • CLoss of confidentiality of patient data stored in the HVAC system.
   • DLoss of availability of the HVAC system, affecting patient comfort and safety.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a direct impact of an attacker successfully compromising an industrial communication channel by injecting false data into a control network?

   • AThe operator may receive misleading information, leading to incorrect decisions or unsafe process conditions.
   • BThe attacker gains physical access to the facility's server room.
   • CThe communication channel becomes encrypted, preventing further monitoring.
   • DThe PLC's firmware is permanently corrupted and must be replaced.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A water plant uses a mix of DNP3 and Modbus TCP. The security team must implement a solution that provides authentication for DNP3 and integrity for Modbus, but they have a limited budget and cannot replace existing RTUs or PLCs. What is the most cost-effective approach?

   • ADisable DNP3 and Modbus and use a proprietary protocol
   • BReplace all RTUs and PLCs with new models that support native security
   • CDeploy a single industrial firewall that supports both DNP3 Secure Authentication and Modbus function code filtering
   • DEncrypt all traffic with a VPN
   Reveal Solution Discussion Select an answer first