EC-COUNCIL ICS-SCADA Online Practice Questions and Exam Preparation

EC-COUNCIL ICS-SCADA Online Questions & Answers

• Question 61:

  Which of the following is NOT ICS specific malware?

  A. Flame
  B. Ha vex
  C. Code Red
  D. Stuxnet
  C. Code Red

  ---

  Explanation

  Code Red is not ICS specific malware; it was a famous worm that targeted computers running Microsoft's IIS web server. Unlike Flame, Havex, and Stuxnet, which were specifically designed to target industrial control systems or perform

  espionage related to ICS environments, Code Red was aimed at exploiting vulnerabilities in internet-facing software to perform denial-of-service attacks and other malicious activities.

  References:

  CERT Coordination Center, "Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL".

• Question 62:

  Which of the following steps is used to reveal the IP addressing?

  A. Footprinting
  B. Surveillance
  C. Cover your tracks
  D. Enumeration
  D. Enumeration

  ---

  Explanation

  Enumeration is a step in the information-gathering phase of a penetration test or cyber attack where an attacker actively engages with the target to extract detailed information, including IP addressing.

  Enumeration: During enumeration, the attacker interacts with network services to gather information such as user accounts, network shares, and IP addresses.

  Techniques: Common techniques include using tools like Nmap, Netcat, and Nessus to scan for open ports, services, and to identify the IP addresses in use.

  Purpose: The goal is to map the network's structure, find potential entry points, and understand the layout of the target environment.

  Because enumeration involves discovering detailed information including IP addresses, it is the correct answer.

  References:

  "Enumeration in Ethical Hacking," GeeksforGeeks, Enumeration.

  "Network Enumeration," Wikipedia,Network Enumeration.

• Question 63:

  What is used in the Modbus protocol to tell the slave to read or write?

  A. None of these
  B. Function code
  C. Unit ID
  D. Slave command
  B. Function code

  ---

  Explanation

  In the Modbus protocol, the function code is used to tell the slave device what kind of action to perform, such as reading or writing data.

  Modbus function codes specify the type of operation to be performed on the registers. For example, function code 03 is used to read holding registers, and function code 06 is used to write a single register.

  Each function code is a single byte in size and is positioned at the start of the PDU (Protocol Data Unit)

  in the Modbus message structure, directly influencing how the slave interprets and executes the request.

  References:

  "Modbus Application Protocol Specification V1.1b," Modbus Organization.

  "The Modbus Protocol Explained," by Schneider Electric.

• Question 64:

  Which of the ICS/SCADA generations is considered distributed?

  A. Fourth
  B. Second
  C. Third
  D. First
  C. Third

  ---

  Explanation

  The third generation of ICS/SCADA systems is considered distributed. This generation features systems that are networked and interconnected, typically using a variety of standard communication protocols. This distribution allows for broader

  connectivity and integration with other systems, enhancing operational flexibility and efficiency but also introducing more vectors for potential cyber threats.

  References:

  Joseph Weiss, "Protecting Industrial Control Systems from Electronic Threats".

  The third generation of ICS/SCADA systems is considered distributed. These systems emerged in the late 1990s and early 2000s and were designed to overcome the limitations of earlier generations by leveraging networked architectures.

  Distributed Architecture: Third-generation systems distributed control functions across multiple interconnected devices and systems, providing greater scalability and flexibility.

  Network Integration: These systems integrated more extensively with IT networks, allowing for remote monitoring and control.

  Standard Protocols: Adoption of standard communication protocols (e.g., Ethernet, TCP/IP) facilitated interoperability and integration with other systems.

  Enhanced Redundancy: Improved fault tolerance and redundancy were implemented to ensure system reliability.

  Due to these features, the third generation is known as the distributed generation.

  References:

  "SCADA Systems," SCADAHacker, SCADA Generations.

  Knapp, J. Langill, "Industrial Network Security," Syngress, 2014.

• Question 65:

  What share does the WannaCry ransomware use to connect with the target?

  A. $IPC
  B. $Admin
  C. $SPOOL
  D. $C
  A. $IPC

  ---

  Explanation

  The WannaCry ransomware utilizes the $IPC (Inter-Process Communication) share to connect with and infect target machines. This hidden network share supports the operation of named pipes, which facilitates the communication necessary

  for WannaCry to execute its payload across networks.

  References:

  CISA Analysis Report, "WannaCry Ransomware".

  WannaCry ransomware uses the SMB (Server Message Block) protocol to propagate through networks and connect to target systems. Specifically, it exploits a vulnerability in SMBv1, known as EternalBlue (MS17-010).

  IPC Share: The $IPC (Inter-Process Communication) share is a hidden administrative share used for inter-process communication. WannaCry uses this share to gain access to other machines on the network.

  SMB Exploitation: By exploiting the SMB vulnerability, WannaCry can establish a connection to the $IPC share, allowing it to execute the payload on the target machine.

  Propagation: Once connected, it deploys the DoublePulsar backdoor and then spreads the ransomware payload.

  Given these details, the correct answer is $IPC.

  References:

  "WannaCry Ransomware Attack," Wikipedia,WannaCry.

  "MS17-010: Security Update for Windows SMB Server," Microsoft,MS17-010.

• Question 66:

  How many main score areas are there in the CVSS?2

  A. 2
  B. 4
  C. 3
  D. None of these
  C. 3

  ---

  Explanation

  The Common Vulnerability Scoring System (CVSS) is a framework for rating the severity of security vulnerabilities. CVSS provides three main score areas: Base, Temporal, and Environmental.

  Base Scoreevaluates the intrinsic qualities of a vulnerability.

  Temporal Scorereflects the characteristics of a vulnerability that change over time.

  Environmental Scoreconsiders the specific impact of the vulnerability on a particular organization, tailoring the Base and Temporal scores according to the importance of the affected IT asset.

  References:

  FIRST, "Common Vulnerability Scoring System v3.1: Specification Document".

• Question 67:

  Which of the IEC 62443 security levels is identified by a hacktivist/terrorist target?

  A. 1
  B. 3
  C. 4
  D. 2
  C. 4

  ---

  Explanation

  IEC 62443 defines multiple security levels (SLs) tailored to address different types of threats and attackers in industrial control systems.

  Security Level 4 (SL4) is designed to protect against sophisticated attacks by adversaries such as hacktivists or terrorists. SL4 involves threats that are targeted with specific intent against the organization, using advanced skills and means.

  This level assumes that the adversary is capable of sustained and focused efforts with significant

  resources, including state-level actors or well-funded groups, aiming at causing widespread disruption or damage.

  References

  IEC 62443-3-3: System security requirements and security levels.

  "Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems," by Eric Knapp.

• Question 68:

  What does the SPI within IPsec identify?

  A. Security Association
  B. Key Exchange
  C. Decryption algorithm
  D. All of these
  A. Security Association

  ---

  Explanation

  Within IPsec, the SPI (Security Parameter Index) is a critical component that uniquely identifies a Security Association (SA) for the IPsec session. The SPI is used in the IPsec headers to help the receiving party determine which SA has been

  agreed upon for processing the incoming packets. This identification is crucial for the proper operation and management of security policies applied to the encrypted data flows.

  References:

  RFC 4301, "Security Architecture for the Internet Protocol," which discusses the structure and use of the SPI in IPsec communications.

• Question 69:

  What version of SMB did the WannaCry ransomware attack?

  A. All of these
  B. 2
  C. 1
  D. 3
  C. 1

  ---

  Explanation

  The WannaCry ransomware primarily exploited vulnerabilities in the SMB (Server Message Block) version 1 protocol to propagate across network systems. Microsoft had identified vulnerabilities in SMBv1, which were exploited by the

  EternalBlue exploit to spread the ransomware. This led to widespread infections, particularly in systems that had not applied the security updates released to patch the vulnerability.

  References:

  Microsoft Security Bulletin MS17-010, "Security Update for Microsoft Windows SMB Server".

• Question 70:

  Which of the hacking methodology steps can be used to identify the applications and vendors used?

  A. Enumeration
  B. OSINT
  C. Scanning
  D. Surveillance
  B. OSINT

  ---

  Explanation

  OSINT (Open Source Intelligence) refers to the collection and analysis of information gathered from public, freely available sources to be used in an intelligence context. In the context of hacking methodologies, OSINT can be used to identify

  applications and vendors employed by a target organization by analyzing publicly available data such as websites, code repositories, social media, and other internet-facing resources.

  References:

  Michael Bazzell, "Open Source Intelligence Techniques".