CompTIA CASP+ (CAS-004) — Question 615

The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network. A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:

SECURE BOOT FAILED:
FIRMWARE MISMATCH EXPECTED 0xFDC479 ACTUAL 0x79F31B

During the investigation, this modified firmware version was identified on several other controllers at the site. The official vendor firmware versions do not have this checksum. Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?

Answer options

• A. Evasion
• B. Persistence
• C. Collection
• D. Lateral movement

Correct answer: B

Explanation

The correct answer is B, Persistence, as the modified firmware indicates an attempt to maintain control over the ICS devices by installing unauthorized software. The other options do not fit this scenario; Evasion pertains to avoiding detection, Collection refers to gathering data, and Lateral movement involves moving within the network after gaining initial access.