EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 1:

  Which of the following is considered the best way to counter packet monitoring for a switch?

  A. Tap
  B. Duplication
  C. SPAN
  D. Port mirror
  D. Port mirror

  ---

  Explanation

  Port mirroring (also known as SPAN - Switched Port Analyzer) is considered one of the best ways to counter packet monitoring on a switch. This technique involves copying traffic from one or more switch ports (or an entire VLAN) to another

  port where the monitoring device is connected. Port mirroring allows administrators to monitor network traffic in a non-intrusive way, as it does not affect network performance and is transparent to users and endpoints on the network.

  References:

  Cisco Systems, "Catalyst Switched Port Analyzer (SPAN) Configuration Example".

• Question 2:

  Which of the following is known as a prebuilt directional gateway that is unidirectional?

  A. Firewall
  B. Data Diode
  C. None of these
  D. Unigate
  B. Data Diode

  ---

  Explanation

  A data diode is known as a prebuilt directional gateway that is unidirectional, designed specifically to allow data to travel in only one direction, ensuring secure one-way communication. This feature makes data diodes ideal for environments

  where it iscritical to prevent any possibility of data leakage or unauthorized access from an external network back to a secure network. Data diodes are commonly used in military and industrial applications, including ICS/SCADA systems, to

  protect sensitive information.

  References:

  U.S. Department of Energy, "Cybersecurity for SCADA Systems".

• Question 3:

  Which mode within IPsec provides a secure connection tunnel between two endpoints AND protects the sender and the receiver?

  A. Protected
  B. Tunnel
  C. Transport
  D. Covered
  B. Tunnel

  ---

  Explanation

  IPsec (Internet Protocol Security) has two modes: Transport mode and Tunnel mode.

  Tunnel mode is used to create a secure connection tunnel between two endpoints (e.g., two gateways, or a client and a gateway) and it encapsulates the entire IP packet.

  This mode not only protects the payload but also the header information of the original IP packet, thereby providing a higher level of security compared to Transport mode, which only protects the payload.

  References

  Kent, S. and Seo, K., "Security Architecture for the Internet Protocol," RFC 4301, December 2005. "IPsec Services," Microsoft TechNet.

• Question 4:

  Which of the following was attacked using the Stuxnet malware?

  A. PLCS
  B. PLC3
  C. All of these
  D. PLC7
  A. PLCS

  ---

  Explanation

  Stuxnet is a highly sophisticated piece of malware discovered in 2010 that specifically targeted Supervisory Control and Data Acquisition (SCADA) systems used to control and monitor industrial processes.

  The primary targets of Stuxnet were Programmable Logic Controllers (PLCs), which are critical components in industrial control systems.

  Stuxnet was designed to infect Siemens Step7 software PLCs. It altered the operation of the PLCs to cause physical damage to the connected hardware, famously used against Iran's uranium enrichment facility, where it caused the fast-spinning centrifuges to tear themselves apart. References

  Langner, R. "Stuxnet: Dissecting a Cyberwarfare Weapon." IEEE Security and Privacy, May-June 2011. "W32.Stuxnet Dossier," Symantec Corporation, Version 1.4, February 2011.

• Question 5:

  Which component of the IT Security Model is attacked with interruption?

  A. Confidentiality
  B. Availability
  C. Authentication
  D. Integrity
  B. Availability

  ---

  Explanation

  The IT Security Model commonly refers to the CIA Triad, which stands for Confidentiality, Integrity, and Availability.

  An attack on "Availability" is aimed at disrupting the normal functioning and access to data or resources in a network. This type of attack can include actions such as DDoS (Distributed Denial of Service), where overwhelming traffic is sent to a

  system to make it unresponsive.

  The main goal of attacks on availability is to prevent legitimate users from accessing systems or information, which can have significant implications for business operations and security.

  References:

  Understanding the CIA Triad in Cybersecurity:

  https://www.cyber.gov.au/acsc/view-all-content/publications/cia-triad

  Denial of Service What it is and how to prevent it: https://www.us-cert.gov/ncas/tips/ST04-015

• Question 6:

  What is a vulnerability called that is released before a patch comes out?

  A. Initial
  B. Pre-release
  C. Zero day
  D. First
  C. Zero day

  ---

  Explanation

  A vulnerability that is exploited before the vendor has issued a patch or even before the vulnerability is known to the vendor is referred to as a "zero-day" vulnerability. The term "zero-day" refers to the number of days the software vendor has

  had to address and patch the vulnerability since it was made public--zero, in this case.

  References:

  Symantec Security Response, "Zero Day Initiative".

• Question 7:

  What form of attack uses a vector that infects a software package?

  A. Spam
  B. All of these
  C. Quicksand
  D. Watering Hole
  D. Watering Hole

  ---

  Explanation

  A "watering hole" attack is a security exploit in which the attacker seeks to compromise a specific group of end users by infecting websites that members of the group are known to visit.

  The goal is to infect a website that members of a targeted community frequently use with malware. Once a user visits the compromised website, malware can be delivered to the user's system, exploiting vulnerabilities on their device.

  This attack vector is used in scenarios where attackers want to breach secure environments indirectly by targeting less secure points in a network's ecosystem, such as third-party software used within the organization.

  References:

  "Watering Hole Attacks: Detect, Disrupt, and Prevent," by Kaspersky Lab.

  "Emerging Threats in Cybersecurity: Understanding Watering Hole Attacks," published in the Journal of Network Security.

• Question 8:

  When monitoring a network, you receive an ICMP type 8 packet. What does this represent?

  A. Echo request
  B. Echo start
  C. Echo recall
  D. Echo reply
  A. Echo request

  ---

  Explanation

  ICMP (Internet Control Message Protocol) is used in network devices, like routers, to send error messages and operational information indicating success or failure when communicating with another IP address.

  An ICMP type 8 packet specifically is an "Echo Request." It is used primarily by the ping command to test the connectivity between two nodes.

  When a device sends an ICMP Echo Request, it expects to receive an ICMP Echo Reply (type 0) from the target node. This mechanism helps in diagnosing the state and reachability of a network on the Internet or within a private network.

  References:

  RFC 792 Internet Control Message Protocol: https://tools.ietf.org/html/rfc792 Internet Assigned Numbers Authority (IANA) ICMP Parameters:

• Question 9:

  Which of the ICS/SCADA generations is considered networked?

  A. Fourth
  B. Third
  C. Second
  D. First
  B. Third

  ---

  Explanation

  Industrial Control Systems (ICS) have evolved through several generations, each characterized by different technological capabilities and integration levels.

  The third generation of ICS/SCADA systems is considered networked. This generation incorporates more advanced digital and networking technologies, allowing for broader connectivity and communication across different systems and

  components within industrial environments.

  Third-generation SCADA systems are often characterized by their use of standard communication protocols and networked solutions, improving interoperability and control but also increasing the attack surface for potential cyber threats.

  References:

  "Evolution of Industrial Control Systems and Cybersecurity Implications," IEEE Transactions on Industry Applications.

  "Network Security for Industrial Control Systems," by Department of Homeland Security.

• Question 10:

  What is the maximum size in bytes of an ethernet packet?

  A. 1200
  B. 1400
  C. 1500
  D. 1300
  C. 1500

  ---

  Explanation

  The maximum transmission unit (MTU) for Ethernet, which is the largest size of an Ethernet packet or frame that can be sent over the network, is typically 1500 bytes. This size does not include the Ethernet frame's preamble and start frame

  delimiter but does include all other headers and the payload. Ethernet's MTU of 1500 bytes is a standard for most Ethernet networks, especially those conforming to the IEEE 802.3 standard.

  References:

  IEEE 802.3-2012, "Standard for Ethernet".