ICS Security Cybersecurity Threats and Vulnerabilities 3

Question 1

What is the primary risk of using remote desktop tools (RDP, VNC) for ICS remote access without additional controls?

Accepted Answer

Exposure of full desktop environments with weak or no multi-factor authentication

Answer

RDP/VNC sessions without MFA and proper access controls provide attackers who obtain credentials with complete interactive access to ICS workstations.

Question 2

Which MITRE ATT&CK for ICS tactic describes an adversary's attempt to learn about the target ICS environment after initial access?

Accepted Answer

Discovery

Answer

The Discovery tactic in MITRE ATT&CK for ICS covers techniques adversaries use to enumerate network topology, devices, and process information after gaining access.

Question 3

What is 'logic bomb' placement in ICS context?

Accepted Answer

Inserting malicious code that activates under specific process conditions

Answer

A logic bomb is malicious code hidden within legitimate ICS programs that executes only when predefined conditions (e.g., a specific date or process state) are met.

Question 4

Supply chain attacks on ICS environments most commonly involve which vector?

Accepted Answer

Compromised software updates or hardware components from trusted vendors

Answer

Supply chain attacks embed malware or backdoors in legitimate vendor software updates or hardware, leveraging the trusted relationship between vendor and asset owner.

Question 5

What defines a 'zero-day' vulnerability in the context of ICS security?

Accepted Answer

An unknown vulnerability with no available patch at the time of exploitation

Answer

A zero-day vulnerability is unknown to the vendor or public, giving defenders zero days to patch before exploitation occurs.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Security Cybersecurity Threats and Vulnerabilities 3