19 free EC-Council ICS/SCADA Cybersecurity practice questions from the CertStash pack of 75, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 19 free here, all 75 in the pack, and each step includes the one before it.
Get all 75 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
What type of communication protocol does Modbus RTU use?
Show answer and explanation
Correct answer: C. Serial
Modbus RTU (Remote Terminal Unit) is a serial communication protocol that operates over serial lines such as RS-232 or RS-485. It uses serial transmission at the physical layer, making it distinct from network protocols like UDP or ICMP, and differs from SSTP which is a VPN protocol.
Why the other options are wrong
- A. UDP is a transport layer protocol used in TCP/IP, not the underlying transport for Modbus RTU.
- B. ICMP is an Internet Control Message Protocol used for network diagnostics, not a serial communication protocol.
- D. SSTP is a VPN tunneling protocol, not a serial communication protocol used by Modbus RTU.
Question 2
Which of the ICS/SCADA generations is considered monolithic?
Show answer and explanation
Correct answer: B. First
The first generation of ICS/SCADA systems is characterized as monolithic, consisting of large, integrated control systems built as single unified platforms with all components tightly coupled. Subsequent generations introduced distributed architectures, networked components, and greater modularity.
Why the other options are wrong
- A. The second generation introduced distributed control systems, moving away from monolithic architecture.
- C. The fourth generation represents modern cloud-based and highly interconnected systems.
- D. The third generation brought networked systems and further distributed capabilities.
Question 3
Which of the following components is not part of the Authentication Header (AH)?
Show answer and explanation
Correct answer: C. Confidentiality
The IPsec Authentication Header (AH) protects packets with a keyed hash and a sequence number. The hash gives data origin authentication and integrity, and the sequence number gives anti-replay protection. AH does not encrypt anything, so the payload travels in clear text and confidentiality is not one of its services. Encryption is provided by the Encapsulating Security Payload (ESP), which is why deployments that need secrecy use ESP, either alone or together with AH.
Why the other options are wrong
- A. Anti-replay protection is part of AH, provided by the sequence number field.
- B. Data origin authentication is a core AH service, provided by the integrity check value.
- D. Integrity is a core AH service, provided by the keyed hash over the packet.
Question 4
How many main score areas are there in the CVSS?
Show answer and explanation
Correct answer: C. 3
The Common Vulnerability Scoring System (CVSS) divides vulnerability assessment into three main metric groups: Base Score (intrinsic characteristics), Temporal Score (characteristics that change over time), and Environmental Score (characteristics specific to user environments). These three score areas provide a comprehensive framework for vulnerability evaluation.
Why the other options are wrong
- A. Two metric areas are insufficient to capture the full scope of CVSS assessment dimensions.
- B. While CVSS includes multiple components, the main groupings are organized into three primary score areas.
- D. There are established main score areas defined by the CVSS framework.
Question 5
Which of the following is NOT an exploit tool?
Show answer and explanation
Correct answer: D. Nessus
Nessus is a vulnerability scanning and assessment tool that identifies weaknesses and misconfigurations but does not actively exploit vulnerabilities. Canvas, Core Impact, and Metasploit are all exploit frameworks and tools designed to actively develop, test, and deliver exploits against target systems.
Why the other options are wrong
- A. Canvas is an exploit development and delivery platform.
- B. Core Impact is a commercial exploit framework used for penetration testing.
- C. Metasploit is a widely-used exploit framework containing numerous exploit modules.
Question 6
When monitoring a network, you receive an ICMP type 8 packet. What does this represent?
Show answer and explanation
Correct answer: A. Echo request
ICMP Type 8 represents an Echo Request message, commonly used by the ping utility to test network connectivity. The source host sends Type 8 packets, and the destination responds with Type 0 (Echo Reply). This is the standard mechanism for host-to-host reachability testing.
Why the other options are wrong
- B. Echo start is not a standard ICMP message type designation.
- C. Echo recall is not a recognized ICMP message type.
- D. Echo reply is ICMP Type 0, not Type 8.
Question 7
What step of the malware infection installs the malware on the target?
Show answer and explanation
Correct answer: C. Dropper
A dropper is the component that installs the malware on the target. Once it reaches the host, it unpacks or writes the malicious payload to disk, sets it up to run, and often adds persistence so the malware survives a reboot. The dropper may carry the payload inside itself or fetch it after it lands. Delivery methods such as a drive-by download only get the dropper onto the machine, while stagers and initialization routines support the process rather than performing the installation.
Why the other options are wrong
- A. A drive-by is a delivery method that gets code onto the host, not the step that installs the payload.
- B. Init refers to initialization of code that is already installed, not the installation step.
- D. A stager is a small loader that prepares a connection for a larger payload rather than installing the malware.
Question 8
The vulnerability that led to the WannaCry ransomware infections affected which protocol?
Show answer and explanation
Correct answer: D. SMB
WannaCry exploited a vulnerability in the Server Message Block (SMB) protocol, specifically the EternalBlue exploit targeting SMB version 1. This vulnerability (CVE-2017-0144) affected Windows systems and allowed the ransomware to spread rapidly across networks without user interaction.
Why the other options are wrong
- A. Samba is an implementation of SMB for non-Windows systems, but the primary WannaCry vector was Windows SMB.
- B. The vulnerability is well-documented and established.
- C. While RPC services may be involved in network exploitation, the primary WannaCry vulnerability was in the SMB protocol.
Question 9
Which of the registrars contains the information for the domain owners in Europe?
Show answer and explanation
Correct answer: A. RIPENCC
RIPENCC (Réseaux IP Européens Network Coordination Centre) is the regional internet registry responsible for managing IP address and autonomous system number allocation, and the related WHOIS registration records, for Europe, the Middle East, and Central Asia. It maintains the authoritative WHOIS records for the holders of IP address blocks and autonomous system numbers in the European region.
Why the other options are wrong
- B. AFRINIC is the regional registry for Africa, not Europe.
- C. LACNIC is the regional registry for Latin America and the Caribbean, not Europe.
- D. ARIN is the regional registry for North America, not Europe.
Question 10
Which component of the IT Security Model is attacked with interruption?
Show answer and explanation
Correct answer: B. Availability
Availability is the component of the CIA triad attacked through interruption. An interruption attack prevents authorized users from accessing resources or services, making systems unavailable. This differs from confidentiality breaches (unauthorized access) and integrity attacks (unauthorized modification).
Why the other options are wrong
- A. Confidentiality is attacked through disclosure or eavesdropping, not interruption.
- C. Authentication is a control mechanism, not a component of the CIA triad itself.
- D. Integrity is attacked through modification or tampering, not interruption.
Question 11
The NIST SP 800-53 defines how many management controls?
Show answer and explanation
Correct answer: B. 9
NIST SP 800-53 groups its security controls into families, and in Revision 3, the edition covered in ICS/SCADA security, the Configuration Management (CM) family contains nine controls, CM-1 through CM-9. They run from the configuration management policy and procedures, through baseline configuration, configuration change control, security impact analysis, and access restrictions for change, to configuration settings, least functionality, the system component inventory, and the configuration management plan. Together they keep control system configurations known, approved, and protected from unauthorized change.
Why the other options are wrong
- A. Six is too few; the configuration management family defines nine controls.
- C. Five is too few; the configuration management family defines nine controls.
- D. Seven is too few; the configuration management family defines nine controls.
Question 12
In what default directory (fully qualified path) does nmap store scripts?
Show answer and explanation
Correct answer: B. /usr/share/nmap/scripts
Nmap stores its default scripts in the /usr/share/nmap/scripts directory on Linux systems. This is the standard location where the Nmap Scripting Engine (NSE) scripts are installed and where users can add custom scripts for vulnerability scanning and network discovery.
Why the other options are wrong
- A. /usr/share/scripts is a generic path but not the specific nmap scripts directory.
- C. /usr/share/nmap is the parent directory but not the specific scripts subdirectory.
- D. /opt is typically used for third-party applications, not the standard nmap script location.
Question 13
Who developed the ModBus protocol?
Show answer and explanation
Correct answer: C. Modicon
Modicon, a company that later became part of Schneider Electric, developed the Modbus protocol in 1979. Modbus is one of the oldest and most widely used serial communication protocols in industrial settings, particularly in ICS/SCADA systems. Siemens developed other protocols like Profibus, BAC is associated with BACnet, and Motorola is a technology company not primarily known for ICS protocol development.
Why the other options are wrong
- A. Siemens developed Profibus and other protocols but not Modbus.
- B. BAC is associated with the BACnet protocol used in building automation, not Modbus.
- D. Motorola is a telecommunications and electronics company not known for developing Modbus.
Question 14
Which of the following is a component of an IDS?
Show answer and explanation
Correct answer: A. All of these
All of these options represent components or functions of an IDS. An IDS must monitor network traffic and systems, detect suspicious activity or intrusions, and respond to incidents. These three capabilities work together to provide comprehensive intrusion detection and response functionality.
Why the other options are wrong
- B. Respond alone is incomplete; an IDS must also monitor and detect.
- C. Detect alone is incomplete; an IDS must also monitor and respond.
- D. Monitor alone is incomplete; an IDS must also detect and respond.
Question 15
Which of the hacking methodology steps can be used to identify the applications and vendors used?
Show answer and explanation
Correct answer: A. Enumeration
Enumeration is the hacking methodology step used to identify applications, services, vendors, and specific software versions running on target systems. During enumeration, attackers actively query systems to gather detailed information about installed applications and their vendors, which follows the initial scanning phase.
Why the other options are wrong
- B. OSINT (Open Source Intelligence) gathers passive information from public sources but doesn't directly identify running applications on live systems.
- C. Scanning identifies open ports and services but is less granular than enumeration for identifying specific applications and vendors.
- D. Surveillance is a passive reconnaissance technique for gathering background information, not for identifying specific applications.
Question 16
What form of attack uses a vector that infects a software package?
Show answer and explanation
Correct answer: D. Watering Hole
A watering hole attack is a targeted attack strategy where threat actors compromise legitimate websites frequently visited by a specific target group, infecting the software or content served from those sites. This vector is commonly used to distribute malware through compromised software packages or updates. Spam is mass unsolicited messaging, and Quicksand is not a recognized attack vector.
Why the other options are wrong
- A. Spam refers to unsolicited bulk messages and is not an attack vector that infects software packages.
- B. Not all listed options are correct; only the watering hole attack specifically uses this infection vector.
- C. Quicksand is not a recognized cybersecurity attack vector or methodology.
Question 17
What share does the WannaCry ransomware use to connect with the target?
Show answer and explanation
Correct answer: A. $IPC
WannaCry ransomware uses the IPC$ share to connect with target systems. IPC$ is the standard inter-process communication share on Windows systems that facilitates network communication and exploitation. WannaCry exploited the EternalBlue vulnerability to propagate laterally across networks using this shared resource.
Why the other options are wrong
- B. The $Admin share is not the primary vector used by WannaCry for propagation.
- C. The $SPOOL share relates to print queue services and was not WannaCry's exploitation method.
- D. $C is not the share WannaCry uses; its SMB exploit connects through the IPC$ share.
Question 18
Which of the following can be used to view entire copies of web sites?
Show answer and explanation
Correct answer: A. Wayback machine
The Wayback Machine is a digital archive that preserves historical snapshots of entire websites, allowing users to view how websites appeared at different points in time. It is specifically designed to store and retrieve complete copies of web pages and sites.
Why the other options are wrong
- B. Google Cache stores only limited cached versions of current or recent pages, not entire historical site copies.
- C. Netcraft is a tools site for network information and security research, not for viewing archived website copies.
- D. Bing offline is not a recognized tool for viewing entire archived copies of websites.
Question 19
Which of the registrars contains the information for the domain owners in Latin America?
Show answer and explanation
Correct answer: B. LACNIC
LACNIC (Latin America and Caribbean Network Information Centre) is the regional internet registry responsible for managing IP address and autonomous system number allocation, and the related WHOIS registration records, for Latin America and the Caribbean. AFRINIC serves Africa, RIPENCC serves Europe/Middle East/Central Asia, and ARIN serves North America.
Why the other options are wrong
- A. AFRINIC is the registrar for Africa, not Latin America.
- C. RIPENCC is the registrar for Europe, the Middle East, and Central Asia.
- D. ARIN is the registrar for North America.
That was 19 of 75.
The full EC-Council ICS/SCADA Cybersecurity pack has all 75 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 37 free as one PDF by email. Get the Half Pack →