Protocols, Communications, & Compromises GICSP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A natural gas pipeline uses serial Modbus RTU over a leased line to communicate with remote pumps. An attacker gains physical access to the line and splices into it. What is the most likely impact of this communication compromise?

   • AThe attacker can decrypt the traffic because Modbus RTU uses weak encryption.
   • BThe attacker can only cause a denial of service by cutting the line.
   • CThe attacker can only passively monitor the traffic without affecting operations.
   • DThe attacker can read and inject Modbus RTU frames, potentially altering pump commands.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A water utility uses Modbus TCP for remote telemetry. The security team discovers that an attacker has been sending Modbus write commands to a pump's PLC, causing it to run at unsafe speeds. They need to stop this immediately without disrupting normal operations. What is the most effective immediate action?

   • ADisconnect the PLC from the network
   • BChange the PLC's IP address
   • CConfigure the firewall to block all Modbus write function codes (0x05, 0x06, 0x0F, 0x10) from all sources except the HMI
   • DIncrease the polling interval on the HMI
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A water treatment facility uses Modbus TCP between a PLC and an HMI. The network team recently noticed that an engineering workstation on the same VLAN can send arbitrary Modbus function codes to the PLC. Which control would most directly reduce the risk of an attacker exploiting this protocol weakness?

   • ADeploy an industrial firewall that permits only the HMI IP to initiate Modbus TCP sessions to the PLC.
   • BEnable DHCP snooping on the switch to prevent unauthorized devices from obtaining an IP address.
   • CChange the PLC's IP address to a non-routable private range.
   • DInstall an antivirus agent on the engineering workstation.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A power plant's control network uses IEC 61850 GOOSE messages for protection tripping. The security team wants to detect an attacker injecting fake GOOSE messages that could cause a breaker to open. They have a limited budget and cannot add new hardware. What is the most effective detection method?

   • AEnable switch port security to limit MAC addresses
   • BIncrease the GOOSE retransmission rate
   • CConfigure the existing network switches to mirror GOOSE traffic to a software-based IDS running on a server
   • DDisable GOOSE messaging during non-critical periods
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A refinery has a mix of legacy Modbus TCP and modern OPC UA devices. The security team must implement a solution that provides authentication and integrity for both protocols without changing the PLCs. They also need to maintain real-time performance. What is the best approach?

   • AReplace all PLCs with models that support native OPC UA security
   • BEncrypt all traffic with a single VPN tunnel
   • CDisable OPC UA security and rely on network segmentation
   • DDeploy protocol-aware security gateways that terminate and re-emit both Modbus and OPC UA with security
   Reveal Solution Discussion Select an answer first