PT0-001 Question #93: Real Exam Question with Answer & Explanation

The correct answer is A: Launch an SNMP password brute force attack against the device.. Against SCADA devices, brute forcing the SNMP write community string is most destructive because it grants direct ability to modify device operational parameters and influence physical industrial processes.

Attacks and exploits

Question

A security consultant found a SCADA device in one of the VLANs in scope. Which of the following actions would BEST create a potentially destructive outcome against device?

Options

ALaunch an SNMP password brute force attack against the device.
BLunch a Nessus vulnerability scan against the device.
CLaunch a DNS cache poisoning attack against the device.
DLaunch an SMB exploit against the device.

Explanation

Against SCADA devices, brute forcing the SNMP write community string is most destructive because it grants direct ability to modify device operational parameters and influence physical industrial processes.

Common mistakes.

B. Running a Nessus vulnerability scan may crash or degrade a fragile SCADA device as an unintended side effect, but this is not a controlled destructive action that leverages direct operational control of the device.
C. DNS cache poisoning redirects name resolution traffic and could disrupt communications, but it does not provide direct access to the SCADA device's control parameters or operational settings.
D. An SMB exploit requires the target to be running a Windows SMB service, which is not a standard feature of most purpose-built SCADA or ICS hardware controllers.

Concept tested. SCADA device exploitation via SNMP write community string

Reference. https://www.cisa.gov/resources-tools/resources/recommended-practice-securing-industrial-control-systems

Topics

#SCADA#ICS security#SNMP brute force#OT attacks

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice