EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 51:

  How many IPsec modes are there?

  A. Four
  B. Three
  C. None of these
  D. Two
  D. Two

  ---

  Explanation

  IPsec (Internet Protocol Security) primarily operates in two modes: Transport mode and Tunnel mode.

  Transport mode: Encrypts only the payload of each packet, leaving the header untouched. This mode is typically used for end-to-end communication between two systems.

  Tunnel mode: Encrypts both the payload and the header of each IP packet, which is then encapsulated into a new IP packet with a new header. Tunnel mode is often used for network-to-network communications (e.g., between two gateways)

  or between a remote client and a gateway.

  References:

  "Security Architecture for the Internet Protocol," RFC 4301. "IPsec Modes of Operation," by Internet Engineering Task Force (IETF).

• Question 52:

  Which of the following is NOT an exploit tool?

  A. Canvas
  B. Core Impact
  C. Metasploit
  D. Nessus
  D. Nessus

  ---

  Explanation

  Among the options listed, Nessus is primarily a vulnerability assessment tool, not an exploit tool. It is used to scan systems, networks, and applications to identify vulnerabilities but does not exploit them. On the other hand, Canvas, Core

  Impact, and Metasploit are exploit tools designed to actually perform attacks (safely and legally) to demonstrate the impact of vulnerabilities.

  References:

  Tenable, Inc., "Nessus FAQs".

• Question 53:

  How many IPsec rules are there in Microsoft Firewall configuration?

  A. 2
  B. 5
  C. 3
  D. 4
  D. 4

  ---

  Explanation

  In the configuration of Microsoft Windows Firewall with Advanced Security, you can define IPsec rules as part of your security policy. Typically, these rules can be organized into four main categories: Allow connection, Block connection, Allow

  if secure (which can specify encryption or authentication requirements), and Custom. While the interface and features can vary slightly between Windows versions, four fundamental types of rules regarding how traffic is handled are commonly

  supported.

  References:

  Microsoft documentation, "Windows Firewall with Advanced Security".

• Question 54:

  In what default directory (fully qualified path) does nmap store scripts?

  A. /usr/share/scripts
  B. /ust/share/nmap/scripts
  C. /usr/share/nmap
  D. /opt
  C. /usr/share/nmap

  ---

  Explanation

  Nmap (Network Mapper) is a network scanning and security auditing tool. Scripts used by Nmap for performing different network discovery and security auditing tasks are stored in /usr/share/nmap/scripts . This directory contains a collection

  of scripts for NSE (Nmap Scripting Engine), which enables Nmap to perform additional networking tasks, often used for detecting vulnerabilities, misconfigurations, and security-related information about network services.

  References:

  Nmap documentation, "Nmap Scripting Engine (NSE)".

• Question 55:

  The vulnerability that led to the WannaCry ransomware infections affected which protocol?

  A. Samba
  B. None of these
  C. RPC
  D. SMB
  D. SMB

  ---

  Explanation

  WannaCry is a ransomware attack that spread rapidly across multiple computer networks in May 2017. The vulnerability exploited by the WannaCry ransomware was in the Microsoft Windows implementation of the Server Message Block (SMB) protocol.

  Specifically, the exploit, known as EternalBlue, targeted a flaw in the SMBv1 protocol. This flaw allowed the ransomware to spread within corporate networks without any user interaction, making it one of the fastest-spreading and most

  harmful cyberattacks at the time.

  References Microsoft Security Bulletin MS17-010 Critical:https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010

  National Vulnerability Database, CVE-2017-0144:https://nvd.nist.gov/vuln/detail/CVE-2017-0144

• Question 56:

  A Virtual Private Network (VPN) requires how many Security Associations?

  A. 5
  B. 4
  C. 3
  D. 2
  D. 2

  ---

  Explanation

  A Virtual Private Network (VPN) typically requires two Security Associations (SAs) for a secure communication session. One SA is used for inbound traffic, and the other for outbound traffic.

  In the context of IPsec, which is often used to secure VPN connections, these two SAs facilitate the bidirectional secure exchange of packets in a VPN tunnel.

  Each SA uniquely defines how traffic should be securely processed, including the encryption and authentication mechanisms. This ensures that data sent in one directionis handled independently from data sent in the opposite direction,

  maintaining the integrity and confidentiality of both communication streams.

  References:

  "Understanding IPSec VPNs," by Cisco Systems.

  "IPsec Security Associations," RFC 4301, Security Architecture for the Internet Protocol.

• Question 57:

  At what layer does a switch normally operate?

  A. 4
  B. 7
  C. 2
  D. 3
  C. 2

  ---

  Explanation

  A network switch typically operates at Layer 2 of the OSI model, which is the Data Link layer. This layer is responsible for node-to-node data transfer--a function that involves handling data frames between physical devices on the same

  network or link. The switch uses MAC addresses to forward data to the appropriate destination within the network.

  References:

  Andrew S. Tanenbaum, "Computer Networks".

• Question 58:

  How many firewalls are there in the most common ICS/SCADA architecture?

  A. 3
  B. 1
  C. None of these
  D. 2
  D. 2

  ---

  Explanation

  The most common ICS/SCADA architecture typically includes two firewalls. This dual firewall configuration often involves one firewall placed between the enterprise network and the ICS/SCADA network, and another between the ICS/SCADA

  network and the plant floor devices. This arrangement, known as a "demilitarized zone" (DMZ) between the two firewalls, adds an additional layer of security to help isolate and protect sensitive operational technology (OT) environments from

  threats originating from IT networks.

  References:

  National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

• Question 59:

  What type of protocol is represented by the number 6?

  A. IUDP
  B. IGRP
  C. ICMP
  D. TCP
  D. TCP

  ---

  Explanation

  The protocol number 6 represents TCP (Transmission Control Protocol) in the Internet Protocol suite. TCP is a core protocol of the Internet Protocol suite and operates at thetransport layer, providing reliable, ordered, and error-checked

  delivery of a stream of bytes between applications running on hosts communicating via an IP network.

  References:

  RFC 793, "Transmission Control Protocol," which specifies the detailed operation of TCP.

• Question 60:

  Which of the IPsec headers contains the Security Parameters Index (SPI)?

  A. AH
  B. Both AH and ESP
  C. ESP
  D. ICV
  B. Both AH and ESP

  ---

  Explanation

  IPsec uses two main protocols to secure network communications: Authentication Header (AH) and Encapsulating Security Payload (ESP).

  Both AH and ESP use a Security Parameters Index (SPI), which is a critical component of their headers. The SPI is a unique identifier that enables the receiver to select the correct security association for processing incoming packets.

  AH provides authentication and integrity, while ESP provides confidentiality, in addition to authentication and integrity. Both protocols use the SPI to manage these functions securely.

  References:

  "IPsec Security Architecture," RFC 4302 (AH) and RFC 4303 (ESP).

  "IPsec Explained," by Juniper Networks.