312-50 Question 424
Single answer▪ OT AttacksDuring an authorized assessment of a manufacturing plant, you are asked to evaluate the risk of cyber attacks against the OT environment without causing operational disruption. The plant uses a SCADA server, several PLCs on a flat control network, and an engineering workstation that periodically uploads logic changes to the controllers. Management wants to know which attacker action would present the most immediate risk of physical process manipulation if an adversary first gained access to the engineering workstation from the IT network. Which action best fits that objective?
- A
Use the engineering workstation to upload modified ladder logic to the PLCs, changing setpoints and control behavior
- B
Run an aggressive TCP port scan across the PLC subnet to identify every listening service before attempting any change
- C
Delete historical logs from the SCADA historian so operators cannot review prior process events
- D
Capture operator HMI screenshots from the workstation to understand the current plant status
Show answer and explanation
Correct answer: A
Explanation
The best answer is the use of the engineering workstation to upload modified PLC logic. In OT and ICS environments, engineering workstations often have trusted access to controllers and use legitimate vendor protocols and programming software. If compromised, they can become the fastest and most effective path to altering industrial processes. This is why standards and guidance such as NIST SP 800-82, Guide to Operational Technology Security, emphasize protecting engineering workstations, restricting remote access paths between IT and OT, and tightly controlling changes to PLC logic. By contrast, aggressive scanning is risky in OT because availability and safety take priority, and many industrial devices are sensitive to malformed or excessive traffic. Deleting logs and taking screenshots may support an attack, but they are not the most immediate route to process manipulation. The scenario tests understanding of how OT attacks often focus on trusted control assets and logic manipulation rather than traditional IT-centric objectives alone.
- A. Correct.
Correct. In many OT environments, the engineering workstation is a high-value target because it is used to program and manage PLCs. If an attacker compromises it, they may be able to push altered logic, modify setpoints, or change control routines directly on controllers. That creates the most immediate path to physical process manipulation, which is a primary concern in OT attacks. This reflects real-world ICS attack patterns in which adversaries leverage trusted engineering tools and authorized communication paths rather than relying only on noisy network exploitation.
- B. Incorrect.
Incorrect. While scanning may help identify devices and services, aggressive scanning is not the best answer in this scenario and can itself disrupt fragile OT devices or communications. More importantly, it does not directly achieve immediate physical manipulation of the process. In OT assessments, passive discovery and extreme caution are generally preferred over noisy enumeration.
- C. Incorrect.
Incorrect. Deleting historian logs may hinder incident response or reduce visibility into previous events, but it does not directly alter the physical process. It is more aligned with anti-forensics or concealment than with immediate manipulation of pumps, valves, motors, or other industrial operations.
- D. Incorrect.
Incorrect. Capturing HMI screenshots could improve situational awareness for an attacker and help them understand process conditions, but by itself it does not change controller behavior or process outputs. It is a reconnaissance step, not the most direct means of physical impact.