Exam objective
CEHIoT and OT Hacking
This objective sits in Mobile Platform, IoT, and OT Hacking, which carries 10% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.
Objective title verbatim from the official objectives. EC-Council exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An assessor finds several substation devices still answering on their factory account. The vendor states the username on one model cannot be changed. What is the correct finding?
Correct.
Checked against attack.mitre.org, September 2026Concept
Preset accounts ship so equipment can be commissioned at all, and they stay valuable to anyone who reads the manual. Where an identifier cannot be altered, the control moves to the network around it.
Why A
These are manufacturer or supplier set defaults on control system devices, and best practice is to change the passwords as soon as possible; where a username cannot be changed the risk has to be handled elsewhere.
Source
MITRE ATT&CK for ICS, Insecure Credentials: Default Credentials (T1694.001), checked September 2026It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed.... Default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled.... M0801 Access Management: Ensure embedded controls and network devices are protected through access management…
Now you: practice questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
During an incident at a water utility, outstations acted on control messages that the real SCADA master never sent, and some polling responses stopped arriving. Which technique fits?
Sample question 2 of 3
An engineer notices a PLC reported a switch from Run to Program mode at 03:00, with no work order. What does that change give an intruder?
Sample question 3 of 3
A team plans an asset inventory of a plant network and proposes a full ping sweep during production. The OT lead objects. What is the strongest reason?
That’s 3 of the full CEH bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.