10 free EC-Council ICS/SCADA Cybersecurity practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 75 questions. Work through them, then open each answer to check your reasoning.
Get all 75 questions (US$39) · Download these 10 as a PDF
Question 1
What type of communication protocol does Modbus RTU use?
Show answer and explanation
Correct answer: C. Serial
Modbus RTU (Remote Terminal Unit) is a serial communication protocol that operates over RS-232 or RS-485 serial connections. It uses a master-slave architecture and transmits data in binary format over serial lines, making serial communication the defining characteristic of Modbus RTU.
Why the other options are wrong
- A. UDP is a network layer protocol used for IP-based communications, not serial protocols like Modbus RTU.
- B. ICMP is an Internet Control Message Protocol used for network diagnostics, not for industrial device communication.
- D. SSTP is a VPN tunneling protocol, completely unrelated to Modbus communication standards.
Question 2
Which of the ICS/SCADA generations is considered monolithic?
Show answer and explanation
Correct answer: B. First
The first generation of ICS/SCADA systems is characterized as monolithic, consisting of standalone, integrated systems with proprietary hardware and software that performed all control functions within a single unit without network connectivity.
Why the other options are wrong
- A. The second generation introduced distributed control systems (DCS) with networked components, moving away from monolithic architecture.
- C. The third generation brought SCADA systems with more open standards and remote access capabilities.
- D. The fourth generation represents modern ICS with cloud integration and advanced cybersecurity considerations.
Question 3
Which of the following components is not part of the Authentication Header (AH)?
Show answer and explanation
Correct answer: C. Confidentiality
The Authentication Header (AH) in IPsec provides authentication, integrity, and replay protection for IP packets, but does not provide confidentiality. Confidentiality (encryption) is provided by the Encapsulating Security Payload (ESP) component of IPsec, not by AH.
Why the other options are wrong
- A. Replay protection is a core function of AH, which uses sequence numbers to prevent replay attacks.
- B. Authentication is the primary function of the Authentication Header.
- D. Integrity verification is a fundamental capability of AH, ensuring data has not been altered in transit.
Question 4
How many main score areas are there in the CVSS?
Show answer and explanation
Correct answer: C. 3
The Common Vulnerability Scoring System (CVSS) contains three main score areas: Base Score (measuring intrinsic qualities of a vulnerability), Temporal Score (accounting for factors that change over time), and Environmental Score (reflecting organizational and environmental factors). These three areas provide comprehensive vulnerability assessment.
Why the other options are wrong
- A. Two score areas would omit important dimensions of vulnerability assessment such as environmental context.
- B. Four score areas exceeds the actual CVSS framework structure of three main scoring groups.
- D. CVSS definitively contains main score areas; this option is incorrect.
Question 5
Which of the following is NOT an exploit tool?
Show answer and explanation
Correct answer: D. Nessus
Nessus is a vulnerability scanner and assessment tool designed to identify security weaknesses in systems and networks. It does not exploit vulnerabilities but rather detects and reports them. Canvas, Core Impact, and Metasploit are all active exploitation frameworks and tools used to execute attacks against discovered vulnerabilities.
Why the other options are wrong
- A. Canvas is an exploitation framework that contains payload generation and delivery capabilities.
- B. Core Impact is a commercial exploitation platform used for penetration testing and active vulnerability exploitation.
- C. Metasploit is the industry-standard exploitation framework containing thousands of exploits and payloads.
Question 6
When monitoring a network, you receive an ICMP type 8 packet.
What does this represent?
Show answer and explanation
Correct answer: A. Echo request
ICMP Type 8 represents an Echo Request message, which is the packet sent when performing a ping operation to test connectivity to a remote host. The receiving host responds with ICMP Type 0 (Echo Reply). This is a fundamental diagnostic tool in network troubleshooting.
Why the other options are wrong
- B. Echo start is not a valid ICMP message type designation.
- C. Echo recall is not a recognized ICMP message type.
- D. Echo reply is ICMP Type 0, not Type 8; Type 0 is the response to an echo request.
Question 7
What step of the malware infection installs the malware on the target?
Show answer and explanation
Correct answer: C. Dropper
The Dropper is the malware component responsible for delivering and installing the actual malicious payload onto the target system. It downloads and executes the primary malware, establishing it on the infected host. This is the installation stage of the malware infection lifecycle.
Why the other options are wrong
- A. Drive-by is a delivery mechanism where malware is downloaded without user consent via compromised websites, not the installation step itself.
- B. Init typically refers to initialization routines, not the installation component of malware.
- D. Stager is an early-stage component that prepares the system and may download the full payload, but the dropper performs the actual installation.
Question 8
The vulnerability that led to the WannaCry ransomware infections affected which protocol?
Show answer and explanation
Correct answer: D. SMB
WannaCry exploited a vulnerability in the Server Message Block (SMB) protocol, specifically the EternalBlue exploit targeting CVE-2017-0144. SMB is used for file sharing and network resource access in Windows environments, and this vulnerability allowed the ransomware to propagate rapidly across networks through unpatched systems.
Why the other options are wrong
- A. Samba is a Linux/Unix implementation of SMB protocols; while related, the primary vulnerability was in Windows SMB.
- B. This option incorrectly states no protocol was involved when SMB was definitively the vulnerable protocol.
- C. RPC (Remote Procedure Call) is a different protocol; the WannaCry vulnerability specifically targeted SMB, not RPC.
Question 9
Which of the registrars contains the information for the domain owners in Europe?
Show answer and explanation
Correct answer: A. RIPENCC
RIPENCC (Réseaux IP Européens Network Coordination Centre) is the Regional Internet Registry responsible for allocating IP addresses and managing domain registration for Europe, the Middle East, and parts of Central Asia. It maintains the authoritative registrar information for domain owners in the European region.
Why the other options are wrong
- B. AFRINIC is the Regional Internet Registry for Africa, not Europe.
- C. LACNIC is the Regional Internet Registry for Latin America and the Caribbean, not Europe.
- D. ARIN is the Regional Internet Registry for North America, not Europe.
Question 10
Which component of the IT Security Model is attacked with interruption?
Show answer and explanation
Correct answer: B. Availability
Availability is attacked through interruption attacks, which aim to prevent authorized users from accessing systems or data. Denial of Service (DoS) attacks are classic examples of interruption attacks that compromise availability by making resources unavailable.
Why the other options are wrong
- A. Confidentiality is attacked through disclosure or unauthorized access, not interruption.
- C. Authentication is not part of the original CIA triad; it is compromised through impersonation or credential theft rather than interruption.
- D. Integrity is attacked through modification or alteration of data, not interruption.
That was 10 of 75.
The full EC-Council ICS/SCADA Cybersecurity pack has all 75 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.