EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 1:

  Which mode within IPsec provides secure connection between two endpoints but does NOT protect the sender and the receiver?

  A. Tunnel
  B. Covered
  C. Transport
  D. Protected
  C. Transport

  ---

  explanation:

  Explanation

  IPsec offers two modes of operation: Transport mode and Tunnel mode.

  Transport mode in IPsec provides security for the payload (the message part) of each packet along the communication path between two endpoints.

  In this mode, the IP header of the original packet is not encrypted; it secures only the payload, not protecting the headers. This means while the data is protected, information about the sender and receiver as contained in the IP header is not

  obscured.

  References:

  "Security Architecture for IP," RFC 4301. IPsec documentation, Internet Engineering Task Force (IETF).

• Question 2:

  What share does the WannaCry ransomware use to connect with the target?

  A. $IPC
  B. $Admin
  C. $SPOOL
  D. $C
  A. $IPC

  ---

  explanation:

  Explanation

  The WannaCry ransomware utilizes the $IPC (Inter-Process Communication) share to connect with and infect target machines. This hidden network share supports the operation of named pipes, which facilitates the communication necessary

  for WannaCry to execute its payload across networks.

  References:

  CISA Analysis Report, "WannaCry Ransomware".

  WannaCry ransomware uses the SMB (Server Message Block) protocol to propagate through networks and connect to target systems. Specifically, it exploits a vulnerability in SMBv1, known as EternalBlue (MS17-010).

  IPC Share: The $IPC (Inter-Process Communication) share is a hidden administrative share used for inter-process communication. WannaCry uses this share to gain access to other machines on the network.

  SMB Exploitation: By exploiting the SMB vulnerability, WannaCry can establish a connection to the $IPC share, allowing it to execute the payload on the target machine.

  Propagation: Once connected, it deploys the DoublePulsar backdoor and then spreads the ransomware payload.

  Given these details, the correct answer is $IPC.

  References:

  "WannaCry Ransomware Attack," Wikipedia,WannaCry.

  "MS17-010: Security Update for Windows SMB Server," Microsoft,MS17-010.

• Question 3:

  At what layer does a switch normally operate?

  A. 4
  B. 7
  C. 2
  D. 3
  C. 2

  ---

  explanation:

  Explanation

  A network switch typically operates at Layer 2 of the OSI model, which is the Data Link layer. This layer is responsible for node-to-node data transfer--a function that involves handling data frames between physical devices on the same

  network or link. The switch uses MAC addresses to forward data to the appropriate destination within the network.

  References:

  Andrew S. Tanenbaum, "Computer Networks".

• Question 4:

  A Security Association is a __________ way connection?

  A. One
  B. None of these
  C. Two
  D. Three
  A. One

  ---

  explanation:

  Explanation

  A Security Association (SA) in the context of IPsec is a one-way logical connection used for secure communication between two endpoints. IPsec requires two SAs to establish a secure, bidirectional communication channel--one for each

  direction (inbound and outbound). This arrangement ensures that each direction is independently secured, with its own set of security parameters.

  References:

  RFC 4301, "Security Architecture for the Internet Protocol".

• Question 5:

  Which of the following is the stance that by default has a default deny approach?

  A. Permissive
  B. Paranoid
  C. Promiscuous
  D. Prudent
  B. Paranoid

  ---

  explanation:

  Explanation

  In the context of network security policies, a "Paranoid" stance typically means adopting a default-deny posture. This security approach is one of the most restrictive, where all access is blocked unless explicitly allowed.

  A default deny strategy is considered best practice for securing highly sensitive environments, as it minimizes the risk of unauthorized access and reduces the attack surface.

  This approach contrasts with more open stances such as Permissive or Promiscuous, which are less restrictive and generally allow more traffic by default.

  References:

  "Network Security: Policies and Guidelines for Effective Network Management," by Jonathan Gossels.

  "Best Practices for Implementing a Security Awareness Program," by Kaspersky Lab.

• Question 6:

  Which component of the IT Security Model is attacked with interruption?

  A. Confidentiality
  B. Availability
  C. Authentication
  D. Integrity
  B. Availability

  ---

  explanation:

  Explanation

  The IT Security Model commonly refers to the CIA Triad, which stands for Confidentiality, Integrity, and Availability.

  An attack on "Availability" is aimed at disrupting the normal functioning and access to data or resources in a network. This type of attack can include actions such as DDoS (Distributed Denial of Service), where overwhelming traffic is sent to a

  system to make it unresponsive.

  The main goal of attacks on availability is to prevent legitimate users from accessing systems or information, which can have significant implications for business operations and security.

  References:

  Understanding the CIA Triad in Cybersecurity:

  https://www.cyber.gov.au/acsc/view-all-content/publications/cia-triad

  Denial of Service What it is and how to prevent it: https://www.us-cert.gov/ncas/tips/ST04-015

• Question 7:

  Which of the registrars contains the information for the domain owners in Latin America?

  A. AFRINIC
  B. LACNIC
  C. RIPENCC
  D. ARIN
  B. LACNIC

  ---

  explanation:

  Explanation

  LACNIC, the Latin American and Caribbean Internet Addresses Registry, is the regional internet registry (RIR) responsible for allocating and administering IP addresses and Autonomous System Numbers (ASNs) in Latin America and the

  Caribbean.

  Function: LACNIC manages the distribution of internet number resources (IP addresses and ASNs) in its region, maintaining the registry of domain owners and other related information.

  Coverage: The organization covers over 30 countries in Latin America and the Caribbean, including countries like Brazil, Argentina, Chile, and Mexico.

  Services: LACNIC provides a range of services including IP address allocation, ASN allocation, reverse DNS, and policy development for internet resource management in its region.

  Given this role, LACNIC is the correct answer for the registrar that contains information for domain owners in Latin America.

  References:

  "About LACNIC," LACNIC, LACNIC Overview.

  "Regional Internet Registries," Wikipedia,Regional Internet Registries.

• Question 8:

  What step of the malware infection installs the malware on the target?

  A. Drive-by
  B. Init
  C. Dropper
  D. Stager
  C. Dropper

  ---

  explanation:

  Explanation

  The term "Dropper" in cybersecurity refers to a small piece of software used in malware deployment that is designed to install or "drop" malware (like viruses, ransomware, spyware) onto the target system.

  The Dropper itself is not typically malicious in behavior; however, it is used as a vehicle to install malware that will perform malicious activities without detection.

  During the infection process, the Dropper is usually the first executable that runs on a system. It then unpacks or downloads additional malicious components onto the system.

  References:

  Malware Enumeration (CME): http://cme.mitre.org Microsoft Malware Protection Center:https://www.microsoft.com/en-us/wdsi

• Question 9:

  Which component of the IT Security Model is the highest priority in ICS/SCADA Security?

  A. Integrity
  B. Authentication
  C. Availability
  D. Confidentiality
  C. Availability

  ---

  explanation:

  Explanation

  In ICS/SCADA systems, the highest priority typically is Availability, due to the critical nature of the services and infrastructures they support. These systems often control vital processes in industries like energy, water treatment, and

  manufacturing. Any downtimecan lead to significant disruptions, safety hazards, or economic losses. Thus, ensuring that systems are operational and accessible is a primary security focus in the context of ICS/SCADA security.

  References:

  National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

• Question 10:

  Which of the TCP flags represents data in the packet?

  A. RST
  B. ACK
  C. PSH
  D. FIN
  C. PSH

  ---

  explanation:

  Explanation

  The PSH (Push) flag in the TCP header instructs the receiving host to push the data to the receiving application immediately without waiting for the buffer to fill. This is used to ensure that data is not delayed, thus improving the efficiency of

  communication where real-time data processing is required. It effectively tells the system that the data in the packet should be considered urgent.

  References:

  Douglas

  E. Comer, "Internetworking with TCP/IP Vol.1: Principles, Protocols, and Architecture".