📘 Free ICS-SCADA Sample Questions
What type of communication protocol does Modbus RTU use?
A
UDP
B
ICMP
C
Serial
D
SSTP
Correct Answer:
C. Serial
Explanation:
Modbus RTU utilizes serial communication. It's a variant of the Modbus protocol designed for serial links, operating over RS-232, RS-485,
or RS-422. Unlike TCP/IP-based protocols which are common in cloud environments and use UDP or TCP, Modbus RTU is directly tied to
physical wiring for its communication. Serial communication is a method of transmitting data one bit at a time over a single wire (or a few
wires for control and ground), making it suitable for long distances and noisy environments, characteristics often found in industrial
settings.
Authoritative Links:
Modbus Organization:
The RTU (Remote Terminal Unit) designation implies its usage in remote locations often connected to central systems through serial
connections. RTU's physical layer is characterized by voltage levels representing binary data, error detection mechanisms like CRC (Cyclic
Redundancy Check), and specific timing constraints. UDP (User Datagram Protocol) is a connectionless protocol used in IP networks, while
https://www.modbus.org/
ICMP (Internet Control Message Protocol) is primarily for error reporting and diagnostics in IP networks. SSTP (Secure Socket Tunneling
Protocol) is a VPN protocol used for secure remote access and is irrelevant to Modbus RTU's serial nature. Thus, serial communication is
the foundation on which Modbus RTU functions and is a key differentiator when considering communication options for ICS/SCADA
environments where legacy serial devices are still prevalent.
Serial Communication: (General information - many sources available) Search for "Serial Communication RS-232 RS-485"
Which of the ICS/SCADA generations is considered monolithic?
A
Second
B
First
C
Fourth
D
Third
Correct Answer:
B. First
Explanation:
The correct answer is B. First. Here's a detailed justification:
contained environments.
within that vendor's ecosystem.
ISC-SCADA: Actual Exam Q&A | CLEARCATNET
The first generation of ICS/SCADA systems is characterized as monolithicdue to its architecture and technological limitations. These
systems, developed primarily from the 1960s to the 1980s, were based on proprietary hardware and software, creating isolated and self
These systems lacked standard communication protocols, making integration with other systems or networks extremely difficult.
Programming was typically done in machine code or assembly language, further hindering interoperability. Each component, from the
master terminal unit (MTU) to the remote terminal units (RTUs), was often supplied by a single vendor and designed to work exclusively
This "monolithic" nature implies that the system operated as a single, large, indivisible entity. Upgrades and modifications were complex
and costly, often requiring complete system replacements rather than incremental improvements. Data sharing was minimal, and security
relied heavily on physical isolation rather than robust cybersecurity measures. Essentially, the first generation operated as a standalone
island, disconnected from modern networking and security principles. Subsequent generations moved towards open standards,
distributed architectures, and improved network integration, moving away from this monolithic model.
Key features that define the first generation and solidify its monolithic designation include:
Proprietary hardware and software
Lack of standardized communication protocols
Limited connectivity to other systems
Centralized architecture
Heavy reliance on physical security
In contrast, later generations (second, third, and fourth) adopted more open standards, distributed architectures, and increasingly
leveraged network connectivity. This progressively enabled better interoperability, scalability, and security capabilities, all traits directly
opposed to the monolithic nature of the first generation.
For further research, consider these resources:
SANS Institute - SCADA Security:
https://www.sans.org/
(Search for SCADA Security topics)
National Institute of Standards and Technology (NIST) - Guide to Industrial Control Systems (ICS) Security (SP 800-82):
https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final
Industrial Control Systems Cyber Emergency Response Team (ICS-CERT):
https://www.cisa.gov/ics
These resources offer detailed information on the evolution of ICS/SCADA systems and the characteristics that define each generation.
Which of the following components is not part of the Authentication Header (AH)?
A
Replay
B
Authentication
C
Confidentiality
D
Integrity
Correct Answer:
C. Confidentiality
Explanation:
The correct answer is C, Confidentiality. The Authentication Header (AH) is a security protocol within the IPsec suite that provides data
integrity, authentication, and anti-replay protection for IP packets. Its primary goal is to ensure that the data received is the same as the
data sent and that the sender is who they claim to be.
Specifically, AH protects against replay attacks using a sequence number field. This sequence number prevents attackers from capturing
and retransmitting packets. Authentication is achieved through cryptographic hashing of the packet's data and header fields, ensuring the
packet's origin is verifiable. Data integrity is also enforced through these cryptographic hashes, validating that the packet hasn't been
tampered with in transit.
However, AH does notprovide confidentiality or encryption. It does not encrypt the data payload, meaning the contents of the packet are
still visible to anyone who intercepts it. Its focus is solely on authentication and integrity. If confidentiality is required, the Encapsulating
Security Payload (ESP) protocol is used, often in conjunction with AH. ESP encrypts the data and also offers integrity and authentication
features.
Therefore, confidentiality is the component that is not part of the Authentication Header (AH).
Supporting Resources:
RFC 4302 - IP Authentication Header:
https://datatracker.ietf.org/doc/html/rfc4302 - Provides the technical specification for the Authentication Header.
IPsec - Wikipedia:
https://en.wikipedia.org/wiki/IPsec - Provides a general overview of the IPsec protocol suite and its components.
How many main score areas are there in the CVSS?
A
2
B
4
C
3
D
None of these
Correct Answer:
C. 3
Explanation:
The correct answer is C. 3 because the Common Vulnerability Scoring System (CVSS) comprises three main score areas: Base, Temporal,
and Environmental.
The Base score represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It
reflects the severity of the vulnerability itself, considering factors such as attack vector, attack complexity, privileges required, user
interaction, scope, confidentiality impact, integrity impact, and availability impact.
The Temporal score represents the characteristics of a vulnerability that change over time but not across user environments. These
factors include exploitability, remediation level, and report confidence. This score adjusts the Base score based on the current state of
exploit techniques and availability of patches or workarounds.
The Environmental score represents the characteristics of a vulnerability that are specific to a user's environment. It allows organizations
to customize the CVSS score based on the importance of the affected IT assets and the security controls in place. It considers factors like
collateral damage potential and target distribution. The Environmental score modifies the Temporal score to reflect the user's specific risk
exposure. These three distinct sets of metrics provide a comprehensive assessment of the risk posed by a particular vulnerability.
Therefore, the three areas allow for a flexible, layered risk assessment, moving from inherent vulnerability features to evolving conditions
and finally, specific operational contexts. Ignoring any of these three components would lead to an incomplete or less useful risk
assessment. The final CVSS score is calculated using a formula that considers all three sets of metrics.
For more information, refer to the official CVSS specification documents:
FIRST (Forum of Incident Response and Security Teams) CVSS:
https://www.first.org/cvss/
Which of the following is NOT an exploit tool?
A
Canvas
B
Core Impact
C
Metasploit
D
Nessus
Correct Answer:
D. Nessus
Explanation:
The correct answer is D. Nessus is a vulnerability scanner, not an exploit tool. Exploit tools are designed to leverage identified
vulnerabilities to gain unauthorized access or control over a system. Canvas, Core Impact, and Metasploit are all frameworks used for
developing and executing exploits. They contain pre-built exploits, utilities for crafting custom exploits, and functionalities for post
exploitation activities like privilege escalation and lateral movement.
Nessus aims to identify them for remediation.
Authoritative links for further research:
https://www.tenable.com/products/nessus
Core Impact:
Nessus, on the other hand, passively scans a network or system to identify potential vulnerabilities. It generates reports detailing these
weaknesses, allowing administrators to patch them before they can be exploited. While vulnerability scanners are crucial for security
assessments, they themselves do not perform any exploitation. The information provided by Nessus could inform an attacker about
potential targets, but Nessus itself doesn't actively exploit those targets. It is a reconnaissance tool used to identify vulnerabilities, not a
weapon used to exploit them. The difference lies in intent and function; exploit tools actively take advantage of vulnerabilities, while
https://www.immunityinc.com/products/canvas/
https://www.coresecurity.com/products/core-impact
Metasploit:
https://www.rapid7.com/products/metasploit/
When monitoring a network, you receive an ICMP type 8 packet. What does this represent?
A
Echo request
B
Echo start
C
Echo recall
D
Echo reply
Correct Answer:
A. Echo request
Explanation:
The correct answer is A, Echo request, because ICMP (Internet Control Message Protocol) type 8 packets are specifically designated for
initiating a ping operation. A "ping" is a fundamental network diagnostic tool used to test the reachability of a host on an IP network. The
process involves sending an ICMP Echo request to the target host and waiting for an ICMP Echo reply. The originating host sends an ICMP
type 8 packet (Echo request), and if the target is reachable and configured to respond, it replies with an ICMP type 0 packet (Echo reply).
ICMP itself is crucial for network diagnostics and control, operating at the network layer (Layer 3) of the OSI model. In cloud environments,
ICMP is vital for troubleshooting connectivity issues within virtual networks and between cloud resources and external networks. For
example, you might use ping from a virtual machine in AWS to check its connectivity to another EC2 instance or to the internet. Properly
configured firewalls or security groups are imperative, and will often allow ICMP packets necessary for network troubleshooting, but may
restrict them to prevent certain attacks.
The Echo request/reply mechanism allows network administrators to verify that a device is online and responsive. The round-trip time
(RTT) calculated from sending the Echo request and receiving the Echo reply gives an indication of the network latency.
The other options are incorrect. There is no "Echo start" or "Echo recall" ICMP type. While an "Echo reply" (ICMP type 0) is related, it
represents the response to the Echo request, not the initial request itself. In ICS-SCADA (Industrial Control Systems - Supervisory Control
and Data Acquisition) environments, understanding network protocols like ICMP is critical for security professionals to monitor network
traffic, identify anomalies, and ensure the availability and reliability of critical infrastructure systems. Malicious actors may exploit ICMP
for reconnaissance or denial-of-service attacks, making it essential to properly monitor and filter ICMP traffic within ICS networks.
Authoritative links for further research:
1. RFC 792 - Internet Control Message Protocol:
https://datatracker.ietf.org/doc/html/rfc792
2. ICMP Types:
https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
What step of the malware infection installs the malware on the target?
A
Drive-by
B
Init
C
Dropper
D
Stager
Correct Answer:
C. Dropper
Explanation:
The correct answer is C. Dropper because it directly relates to the malware infection stage responsible for planting the malicious payload.
Let's break down why the other options are less suitable:
A. Drive-by: A drive-by attack refers to the methodof delivering the initial exploit. It's how the attacker gets access or triggers a download,
not the component that actually installs the malware. It typically involves tricking a user into visiting a compromised website or clicking a
malicious link. This step precedesthe installation stage.
B. Init: "Init" is a general term often used in operating systems for initialization processes. In the context of malware, it could refer to an
initialization routine withinthe malware, but it doesn't represent the specific stage ofinstallingthe main malicious payload.
D. Stager: A stager is a small piece of code whose primary purpose is to download or fetch a larger, more complete payload. It's a first step
in the infection chain, but it's not the final installation component. The stager's job is to preparefor installation, not to perform the actual
installation itself. The dropper often uses the stager.
The Dropper, however, is a type of malware specifically designed toinstallother malware onto a target system. Its main function is to
deliver the malicious code and execute it on the compromised machine. It often employs techniques to evade detection and ensure the
installed malware persists. After the drive-by and the potential stager, the dropper is triggered to install the actual malware components.
The dropper might also configure the system for persistence, setting the malware to run at startup.
In summary, the dropper is the malware component responsible for the actual installation of the malicious payload, placing it on the
system and setting it up to execute. While the other options are related to the overall infection process, they don't define the installation
stage itself.
Authoritative Links:
concept within broader cybersecurity frameworks.
utilized.
NIST (National Institute of Standards and Technology): While NIST doesn't have a single, specific page on "droppers," searching the NIST
Digital Library (available at nvlpubs.nist.gov) for "malware infection stages" or "malware analysis" will provide resources that cover this
MITRE ATT&CK Framework: Although it does not have a dedicated page for droppers specifically, understanding the malware delivery
and execution techniques outlined in MITRE ATT&CK (attack.mitre.org) can illustrate the context of a dropper within the attack lifecycle.
For instance, exploring techniques related to "User Execution" or "Exploitation for Client Execution" can show how a dropper might be
The vulnerability that led to the WannaCry ransomware infections affected which protocol?
A
. Samba
B
None of these
C
RPC
D
SMB
Correct Answer:
D. SMB
Explanation:
The correct answer is D: SMB (Server Message Block). WannaCry leveraged a vulnerability in Microsoft's implementation of the SMBv1
protocol, specifically the "EternalBlue" exploit. This exploit allowed attackers to remotely execute arbitrary code on vulnerable systems.
SMB is a network file-sharing protocol that allows applications on a computer to access files and resources on a remote server. It's widely
used in Windows networks for file sharing, printer sharing, and other networking functions. The vulnerability exploited by EternalBlue
resided within the way SMBv1 handled certain specially crafted packets.
The exploit works by sending a malicious SMBv1 packet to a target machine. This packet triggers a buffer overflow in the SMBv1 handling
code, overwriting parts of memory and allowing the attacker to execute their own code, in this case, installing and running the WannaCry
Relevant Resources:
While RPC (Remote Procedure Call) is also a network protocol used for communication between applications, it was not the specific
protocol directly targeted by the EternalBlue exploit used by WannaCry. Samba is an open-source implementation of the SMB protocol for
Unix-like operating systems, and while related to SMB conceptually, the WannaCry exploit specifically targeted Microsoft's SMB
Microsoft Security Bulletin MS17-010:
Microsoft released a patch for this SMBv1 vulnerability (MS17-010) prior to the WannaCry outbreak. However, many systems remained
unpatched, leaving them susceptible to the attack. The widespread nature of the WannaCry infections highlights the importance of timely
patching and vulnerability management. Understanding the specifics of protocols and their vulnerabilities is crucial for securing systems,
whether they're cloud-based or on-premises. It's also important to disable legacy protocols like SMBv1 where possible to minimize attack
surface. Many cloud providers offer services like vulnerability scanning and patch management to assist with these tasks.
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010
WannaCry Ransomware Technical Details:
https://www.akamai.com/blog/security/technical-analysis-of-wannacry-ransomware
Which of the registrars contains the information for the domain owners in Europe?
A
RIPENCC
B
AFRINIC
C
LACNIC
D
ARIN
Correct Answer:
A. RIPENCC
Explanation:
The correct answer is A, RIPENCC, because it is the Regional Internet Registry (RIR) responsible for providing Internet resources and
related services (like domain owner information) to Europe, the Middle East, and parts of Central Asia. RIRs are organizations that manage
the allocation and registration of Internet number resources within a specific region.
AFRINIC (B) covers Africa. LACNIC (C) manages Latin America and the Caribbean. ARIN (D) is responsible for North America. Thus, only
RIPENCC aligns with the geographical location of Europe as indicated in the question. These RIRs are crucial for the proper functioning of
the internet, as they maintain databases linking domain names with their respective owners. These databases are queried during
processes like WHOIS lookups, which reveal registration information. Knowing which RIR is responsible for which region is fundamental in
understanding internet governance and cybersecurity investigations. If you want to find out who owns a domain registered in Europe, you
need to check the RIPENCC database. For instance, understanding RIR responsibilities is essential when investigating the source of
malicious activity originating from a specific region, allowing cybersecurity professionals to trace the origin effectively.
Here are some authoritative links for further research:
RIPE NCC:
https://www.ripe.net/
AFRINIC:
https://www.afrinic.net/
LACNIC:
https://www.lacnic.net/
ARIN:
https://www.arin.net/
These links provide detailed information about each RIR's responsibilities, services, and geographical coverage.
Which component of the IT Security Model is attacked with interruption?
A
Confidentiality
B
Availability
C
Authentication
D
. Integrity
Correct Answer:
B. Availability
Explanation:
The correct answer is Availability. Interruption, in the context of the IT Security Model, specifically targets the accessibility and
operational readiness of systems and data. An interruption attack aims to make a resource unavailable or unusable, thus directly
impacting availability. This differs from attacks on confidentiality, which aim to expose sensitive information, or attacks on integrity, which
aim to corrupt or alter data. Authentication, which verifies the identity of users or systems, is also not the primary target of interruption.
Consider a Denial-of-Service (DoS) attack on an ICS-SCADA system. The goal isn't to steal confidential process data (confidentiality), alter
setpoints (integrity), or spoof a legitimate operator (authentication). Instead, the attacker floods the control network with traffic,
overwhelming the communication channels and preventing authorized operators from accessing critical control interfaces or receiving
sensor data. This directly halts or hinders the operation of the ICS-SCADA system, rendering it unavailable.
Another example is ransomware targeting an ICS server. While data might eventuallybe corrupted (integrity impact as a secondary effect),
the immediate impact is the inaccessibility of the server and its services, severely impacting availability. The primary aim is to disrupt
operations until a ransom is paid. Therefore, an interruption attack’s core purpose is to deny access to services or resources, which aligns
directly with the concept of availability in the IT Security Model.
In ICS-SCADA, any attack that prevents operators from monitoring processes, issuing commands, or receiving alerts is an interruption
attack. These attacks can have severe consequences, including process shutdowns, equipment damage, and even safety hazards.
Safeguarding the availability of ICS-SCADA systems is paramount for maintaining operational efficiency, safety, and reliability.
Supporting Resources:
NIST SP 800-82r3, Guide to Industrial Control Systems (ICS) Security: This NIST publication provides comprehensive guidance on
securing ICS-SCADA environments, including discussions on availability and security risks.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf
SANS Institute, Securing Industrial Control Systems: SANS offers various resources and training on ICS security, including information
on common attack vectors and mitigation strategies focused on ensuring availability.
https://www.sans.org/industrial-security/
Questions: 1-10 out of 75
Continue Full Practice..
GET ALL 75 QUESTIONS