Hacking IoT and OT Quiz

Q1. IoT devices should ideally be placed:

On the OT control VLAN On a segmented network with restricted outbound access On the main corporate VLAN Directly on the internet

Q2. OT (Operational Technology) refers to:

Web servers Industrial control systems (ICS/SCADA) Office laptops Email servers

Q3. In the rolling code example, the attacker uses a jammer to:

Patch the remote Jam the car's reception while sniffing the code Encrypt the car Disable the Internet

Q4. Active scanning in an OT network is risky because:

It is illegal It is slow It uses bandwidth Legacy controllers can crash or enter a fault state from unexpected traffic

Q5. Vendor remote support connections into OT should be:

Unrestricted Time-limited, monitored, authenticated and disabled by default Undocumented Always on for convenience

Q6. An army of infected IoT devices is referred to as:

A botnet A database A firewall A gateway

Q7. The Access Gateway layer provides:

Only password storage Only database queries Only antivirus Protocol translation and messaging

Q8. IoT devices can send data to:

Cloud servers/data storage Only DNS registrars Only keyboards Only local printers

Q9. In OT environments, the priority order is usually:

Confidentiality only Confidentiality, integrity, availability Availability and safety first, then integrity, then confidentiality Integrity, confidentiality, availability

Q10. Shodan is relevant to IoT security because it:

Manages certificates Encrypts traffic Patches devices Indexes internet-exposed devices including control systems

Q11. The Purdue model is used to:

Rate vulnerabilities Define network segmentation levels between enterprise IT and control systems Encrypt OT traffic Schedule maintenance

Q12. What is a jamming attack?

A web application attack A database attack An attack that disrupts wireless IoT communication using signals on the same frequency A password attack

Q13. The Internet layer provides:

Only authentication Only storage encryption Connection between endpoints Only physical security

Q14. Which is the most realistic control for an unpatchable legacy controller?

Replace it immediately Ignore it Connect it to the internet Isolate it behind strict segmentation and monitor it closely

Q15. A safety instrumented system (SIS) exists to:

Log events Improve efficiency Bring the process to a safe state when conditions become dangerous Manage inventory