EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 11:

  Which of the options in the netstat command show the routing table?

  A. c
  B. a
  C. r
  D. s
  C. r

  ---

  Explanation

  The netstat command is a versatile networking tool used for various network-related information-gathering tasks, including displaying all network connections, routing tables, interface statistics, masquerade connections, and multicast

  memberships.

  The specific option with the -r netstat command is used to display the routing table.

  This information is critical for troubleshooting network issues and understanding how data is routed through a network, identifying possible points of failure or security vulnerabilities.

  References:

  "Linux Network Administrator's Guide," by O'Reilly Media.

  Man pages for netstat in UNIX/Linux distributions.

• Question 12:

  Which mode within IPsec provides secure connection between two endpoints but does NOT protect the sender and the receiver?

  A. Tunnel
  B. Covered
  C. Transport
  D. Protected
  C. Transport

  ---

  Explanation

  IPsec offers two modes of operation: Transport mode and Tunnel mode.

  Transport mode in IPsec provides security for the payload (the message part) of each packet along the communication path between two endpoints.

  In this mode, the IP header of the original packet is not encrypted; it secures only the payload, not protecting the headers. This means while the data is protected, information about the sender and receiver as contained in the IP header is not

  obscured.

  References:

  "Security Architecture for IP," RFC 4301. IPsec documentation, Internet Engineering Task Force (IETF).

• Question 13:

  Which of the following is the stance on risk that by default allows traffic with a default permit approach?

  A. Paranoid
  B. Prudent
  C. Promiscuous
  D. Permissive
  D. Permissive

  ---

  Explanation

  In network security, the stance on managing and assessing risk can vary widely depending on the security policies of an organization.

  A "Permissive" stance, often referred to as a default permit approach, allows all traffic unless it has been specifically blocked. This approach can be easier to manage from a usability standpoint but is less secure as it potentially allows

  unwanted or malicious traffic unless explicitly filtered.

  This is in contrast to a more restrictive policy, which denies all traffic unless it has been explicitly permitted, typically seen in more secure environments.

  References

  "Network Security Basics," by Cisco Systems.

  "Understanding Firewall Policies," by Fortinet.

• Question 14:

  Who developed the ModBus protocol?

  A. Siemens
  B. BAG
  C. Modicon
  D. Motorola
  C. Modicon

  ---

  Explanation

  The Modbus protocol was developed by Modicon, now a brand of Schneider Electric.

  It was originally designed in 1979 for use with its programmable logic controllers (PLCs) in industrial applications.

  Modbus is a serial communications protocol that has become a de facto standard communication protocol and is now commonly used to connect industrial electronic devices. The main reasons for its use are its simplicity and the fact that it is open-source, which allows manufacturers to build their own implementations of the standard. References

  "Modbus Protocol Reference Guide," Modicon, Inc., 1979.

  "A Guide to the Modbus Protocol," Schneider Electric.

• Question 15:

  Which component of the IT Security Model is attacked with eavesdropping and interception?

  A. Confidentiality
  B. Availability
  C. Integrity
  D. Authentication
  A. Confidentiality

  ---

  Explanation

  Eavesdropping and interception primarily attack the confidentiality component of the IT Security Model. Confidentiality is concerned with protecting information from beingaccessed by unauthorized parties. Eavesdropping involves listening to

  private communication or capturing data as it is transmitted over a network, thereby breaching the confidentiality of the information.

  References:

  William Stallings, "Cryptography and Network Security: Principles and Practice".

• Question 16:

  Which of the following is the name of hacking for a cause?

  A. Lulzec
  B. Anonymous
  C. Hacktivism
  D. Suicide Hackers
  C. Hacktivism

  ---

  Explanation

  Hacktivism refers to the act of hacking, or breaking into computer systems, for a politically or socially motivated purpose. Hacktivists use their skills to promote a cause, influence public opinion, or bring attention to social injustices. The term

  combines "hacking" and "activism," representing a form of activism that takes place within cyberspace.

  References:

  Dorothy

  E. Denning, "Activism, Hacktivism, and Cyberterrorism: The Internet as a Tool for Influencing Foreign Policy".

• Question 17:

  What is the size in bytes of the TCP sequence number in the header?

  A. 2
  B. 1
  C. 3
  D. 4
  D. 4

  ---

  Explanation

  In the Transmission Control Protocol (TCP) header, the sequence number field is crucial for ensuring the correct sequencing of the packets sent over a network.

  The sequence number field in the TCP header is 32 bits long, which equates to 4 bytes.

  This sequence number is used to keep track of the bytes in a sequence that are transferred over a TCP connection, ensuring that packets are arranged in the correct order and data integrity is maintained during transmission.

  References

  Postel, J., "Transmission Control Protocol," RFC 793, September 1981. "TCP/IP Guide," Kozierok,

  C. M., 2005.

• Question 18:

  What type of protocol is considered connection-oriented?

  A. UDP
  B. TCP
  C. ICMP
  D. ARP
  B. TCP

  ---

  Explanation

  TCP (Transmission Control Protocol) is a connection-oriented protocol used in the majority of internet communications.

  Connection-oriented protocols like TCP require a connection to be established between the communicating devices before data is transmitted. This ensures reliable and ordered delivery of data.

  TCP manages this by establishing a handshake mechanism (TCP three-way handshake) to set up the

  connection prior to transmitting data and properly terminating the connection once the communication session has completed.

  References:

  "TCP/IP Illustrated, Volume 1: The Protocols" by W. Richard Stevens. Postel, J., "Transmission Control Protocol," RFC 793.

• Question 19:

  In physical to logical asset protections, what threat can be directed against the network?

  A. Elevation of privileges
  B. Flood the switch
  C. All of these
  D. Crack the password
  C. All of these

  ---

  Explanation

  In the context of physical to logical asset protection in network security, several threats can be directed against the network, including:

  Elevation of Privileges: Where unauthorized users gain higher-level permissions improperly.

  Flood the Switch: Typically involves a DoS attack where the switch is overwhelmed with traffic, preventing normal operations.

  Crack the Password: An attack aimed at gaining unauthorized access by breaking through password security. All these threats can potentially compromise the network's security and the safety of its physical and logical assets.

  References:

  CompTIA Security+ Guide to Network Security Fundamentals.

• Question 20:

  Which of the following is a weakness of a vulnerability scanner?

  A. Detect known vulnerabilities
  B. Not designed to go through filters
  C. Work best on a local network
  D. Maintains a signature database
  B. Not designed to go through filters

  ---

  Explanation

  One weakness of a vulnerability scanner is that it is not designed to go through filters or bypass security controls like firewalls or intrusion detection systems. Vulnerability scanners typically perform well in identifying known weaknesses within

  the perimeter of a network or system but might not effectively assess systems that are shielded by robust security measures, which can filter out the scanner's attempts to probe or attack.

  References:

  National Institute of Standards and Technology (NIST), "Technical Guide to Information Security Testing and Assessment".