EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 21:

  What is the default size in bits of the Windows Echo Request packet?

  A. 28
  B. 24
  C. 58
  D. 32
  A. 28

  ---

  Explanation

  The default size of a Windows Echo Request packet, commonly known as a ping request, is 28 bytes. This size is derived from the following components:

  ICMP Header: The Internet Control Message Protocol (ICMP) header is 8 bytes.

  IPv4 Header: The IP header for an IPv4 packet is typically 20 bytes. Therefore, the total size of the default Windows Echo Request packet is 28 bytes (8 bytes for ICMP header + 20 bytes for IPv4 header).

  References:

  "Ping (networking utility)," Wikipedia,Ping. "ICMP Header Format," Cisco, ICMP Header.

• Question 22:

  Which component of the IT Security Model is attacked with masquerade?

  A. Integrity
  B. Availability
  C. Confidentiality
  D. Authentication
  D. Authentication

  ---

  Explanation

  A masquerade attack involves an attacker pretending to be an authorized user of a system, thus compromising the authentication component of the IT security model. Authentication ensures that the individuals accessing the system are who

  they claim to be. By masquerading as a legitimate user, an attacker can bypass this security measure and gain unauthorized access to the system.

  References:

  William Stallings, "Security in Computing".

• Question 23:

  Which of the CVSS metrics refer to the exploit quotient of the vulnerability?

  A. Temporal
  B. Environmental
  C. IBase
  D. All of these
  A. Temporal

  ---

  Explanation

  The Common Vulnerability Scoring System (CVSS) uses several metrics to assess the severity of vulnerabilities. Among them, the Temporal metric group specifically reflects the exploit quotient of a vulnerability.

  Temporal metrics consider factors that change over time after a vulnerability is initially assessed. These include:

  Exploit Code Maturity: This assesses the likelihood of the vulnerability being exploited based on the availability and maturity of exploit code.

  Remediation Level: The level of remediation available for the vulnerability, which influences the ease of mitigation.

  Report Confidence: This metric measures the reliability of the reports about the vulnerability.

  These temporal factors directly affect the exploitability and potential threat posed by a vulnerability, adjusting the base score to provide a more current view of the risk.

  References:

  Common Vulnerability Scoring System v3.1: User Guide.

  "Understanding CVSS," by FIRST (Forum of Incident Response and Security Teams).

• Question 24:

  Which of the following are valid TCP flags?

  A. None of these
  B. IGP,ACK,SYN,PSH,URG
  C. BGP,FIN,PSH,SYN,ACK
  D. FIN,PSH,URG,RST,SYN
  D. FIN,PSH,URG,RST,SYN

  ---

  Explanation

  TCP flags are used in the header of TCP segments to control the flow of data and to indicate the status of a connection. Valid TCP flags include:

  FIN: Finish, used to terminate the connection.

  PSH: Push, instructs the receiver to pass the data to the application immediately.

  URG: Urgent, indicates that the data contained in the segment should be processed urgently.

  RST: Reset, abruptly terminates the connection upon error or other conditions.

  SYN: Synchronize, used during the initial handshake to establish a connection.These flags are integral to managing the state and flow of TCP connections.

  References:

  Douglas

  E. Comer, "Internetworking with TCP/IP Vol.1: Principles, Protocols, and Architecture".

• Question 25:

  Which of the registrars contains the information for the domain owners in Latin America?

  A. AFRINIC
  B. LACNIC
  C. RIPENCC
  D. ARIN
  B. LACNIC

  ---

  Explanation

  LACNIC, the Latin American and Caribbean Internet Addresses Registry, is the regional internet registry (RIR) responsible for allocating and administering IP addresses and Autonomous System Numbers (ASNs) in Latin America and the

  Caribbean.

  Function: LACNIC manages the distribution of internet number resources (IP addresses and ASNs) in its region, maintaining the registry of domain owners and other related information.

  Coverage: The organization covers over 30 countries in Latin America and the Caribbean, including countries like Brazil, Argentina, Chile, and Mexico.

  Services: LACNIC provides a range of services including IP address allocation, ASN allocation, reverse DNS, and policy development for internet resource management in its region.

  Given this role, LACNIC is the correct answer for the registrar that contains information for domain owners in Latin America.

  References:

  "About LACNIC," LACNIC, LACNIC Overview.

  "Regional Internet Registries," Wikipedia,Regional Internet Registries.

• Question 26:

  Which of the following is the stance that by default has a default deny approach?

  A. Permissive
  B. Paranoid
  C. Promiscuous
  D. Prudent
  B. Paranoid

  ---

  Explanation

  In the context of network security policies, a "Paranoid" stance typically means adopting a default-deny posture. This security approach is one of the most restrictive, where all access is blocked unless explicitly allowed.

  A default deny strategy is considered best practice for securing highly sensitive environments, as it minimizes the risk of unauthorized access and reduces the attack surface.

  This approach contrasts with more open stances such as Permissive or Promiscuous, which are less restrictive and generally allow more traffic by default.

  References:

  "Network Security: Policies and Guidelines for Effective Network Management," by Jonathan Gossels.

  "Best Practices for Implementing a Security Awareness Program," by Kaspersky Lab.

• Question 27:

  With respect to data analysis, which of the following is not a step?

  A. Enumeration
  B. All of these
  C. vulnerabilities
  D. Scanning for targets
  A. Enumeration

  ---

  Explanation

  In the context of data analysis, enumeration is not typically considered a step. Enumeration is more relevant in security assessments and network scanning contexts where specific details about devices, users, or services are cataloged. Data

  analysis steps typically include gathering data, preprocessing, analyzing, and interpreting results rather than enumeration, which is more about identifying and listing components in a system or network.

  References:

  "Data Science from Scratch" by Joel Grus, which outlines common steps in data analysis.

• Question 28:

  Which of the monitor alerts is considered most dangerous?

  A. True Positive
  B. False Positive
  C. False Negative
  D. True Negative
  C. False Negative

  ---

  Explanation

  In the context of monitoring and alerts within cybersecurity, the classification of alerts includes true positives, false positives, true negatives, and false negatives.

  A false negative is considered the most dangerous type of alert because it occurs when an actual security threat is present but the monitoring system fails to detect and alert it. This allows malicious activities to occur undetected, potentially leading to significant damage or data loss.

  The risk with false negatives is that they provide a false sense of security, assuming that systems are secure while in reality, they are compromised. References

  "Security and Network Monitoring Basics," Cisco Systems.

  "Understanding Alert Classifications in Cybersecurity," Journal of Information Security.

• Question 29:

  Which of the registrars contains the information for the domain owners in South America?

  A. AFRINIC
  B. ARIN
  C. LACNIC
  D. RIPENCC
  C. LACNIC

  ---

  Explanation

  LACNIC (Latin American and Caribbean Network Information Centre) is the regional Internet registry for Latin America and parts of the Caribbean. It manages the allocation and registration of Internet number resources (such as IP addresses

  and AS numbers) within this region and maintains the registry of domain owners in South America.

  References:

  LACNIC official website, "About LACNIC".

• Question 30:

  The NIST SP 800-53 defines how many management controls?

  A. 6
  B. 9
  C. 5
  D. 7
  B. 9

  ---

  Explanation

  NIST SP 800-53 is a publication that provides a catalog of security and privacy controls for federal information systems and organizations and promotes the development of secure and resilient federal information and information systems.

  According to the NIST SP 800-53 Rev. 5, the framework defines a comprehensive set of controls, which are divided into different families. Among these families, there are specifically nine families categorized under management controls.

  These include categories such as risk assessment, security planning, program management, and others.

  References:

  "NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for Information Systems and Organizations."

  NIST website:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf