2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

EC-Council ICS/SCADA Cybersecurity Exam Practice Questions, practice question pack
EC-COUNCIL · ICS/SCADA Cybersecurity

EC-Council ICS/SCADA Cybersecurity Exam Practice Questions

99% pass rateUpdated 1 Nov 202675 questions2 PDFs, instant download

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 75 questions in this pack

Question 1

What type of communication protocol does Modbus RTU use?

  1. UDP
  2. ICMP
  3. Serial
  4. SSTP
Show answer and explanation

Correct answer: C. Serial

Modbus RTU (Remote Terminal Unit) is a serial communication protocol that operates over serial lines such as RS-232 or RS-485. It uses serial transmission at the physical layer, making it distinct from network protocols like UDP or ICMP, and differs from SSTP which is a VPN protocol.

Why the other options are wrong

  • A. UDP is a transport layer protocol used in TCP/IP, not the underlying transport for Modbus RTU.
  • B. ICMP is an Internet Control Message Protocol used for network diagnostics, not a serial communication protocol.
  • D. SSTP is a VPN tunneling protocol, not a serial communication protocol used by Modbus RTU.

Question 2

Which of the ICS/SCADA generations is considered monolithic?

  1. Second
  2. First
  3. Fourth
  4. Third
Show answer and explanation

Correct answer: B. First

The first generation of ICS/SCADA systems is characterized as monolithic, consisting of large, integrated control systems built as single unified platforms with all components tightly coupled. Subsequent generations introduced distributed architectures, networked components, and greater modularity.

Why the other options are wrong

  • A. The second generation introduced distributed control systems, moving away from monolithic architecture.
  • C. The fourth generation represents modern cloud-based and highly interconnected systems.
  • D. The third generation brought networked systems and further distributed capabilities.

Question 3

Which of the following components is not part of the Authentication Header (AH)?

  1. Replay
  2. Authentication
  3. Confidentiality
  4. Integrity
Show answer and explanation

Correct answer: C. Confidentiality

The IPsec Authentication Header (AH) protects packets with a keyed hash and a sequence number. The hash gives data origin authentication and integrity, and the sequence number gives anti-replay protection. AH does not encrypt anything, so the payload travels in clear text and confidentiality is not one of its services. Encryption is provided by the Encapsulating Security Payload (ESP), which is why deployments that need secrecy use ESP, either alone or together with AH.

Why the other options are wrong

  • A. Anti-replay protection is part of AH, provided by the sequence number field.
  • B. Data origin authentication is a core AH service, provided by the integrity check value.
  • D. Integrity is a core AH service, provided by the keyed hash over the packet.

See all 19 free questions Get the full pack, US$39

How much of the EC-Council ICS/SCADA Cybersecurity bank is free?

75 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 1925% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 37the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 75100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the EC-Council ICS/SCADA Cybersecurity pack

  • 75 questions mapped to the ICS/SCADA Cybersecurity course modules
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

An ICS/SCADA Cybersecurity attempt costs US$699. This pack is US$39, paid once.

What makes the ICS/SCADA Cybersecurity exam hard

The EC-Council ICS/SCADA Cybersecurity exam is an OT security exam written for IT security people, and that is the angle most of the questions take: how is an industrial network different, why does the usual IT answer break a plant, and what should be done instead. It is 75 questions in two hours with a 70% pass mark, and a lot of the marks come from knowing the protocols and the incidents by name.

The course modules drive the blueprint: ICS and SCADA network defence fundamentals covering PLCs, RTUs, HMIs and the Purdue model, TCP/IP review, the hacking methodology applied to industrial environments, vulnerability management with ICS-CERT advisories, standards including IEC 62443, NIST SP 800-82, ISO 27001 and CFATS, securing the ICS network with segmentation and protocol-aware firewalls, and bridging the air gap with intrusion detection.

EC-Council's own material cites Stuxnet and TRITON as case studies, so know what each targeted.

About the exam

The EC-Council ICS/SCADA Cybersecurity certification covers ICS and SCADA network defence, TCP/IP fundamentals, the hacking methodology applied to industrial systems, vulnerability management, standards and regulations, securing ICS networks, bridging the air gap, and intrusion detection in OT environments. Eligibility requires one year of information security work experience plus a US$100 application, unless you take EC-Council's official ICS/SCADA training.

Read the EC-Council ICS/SCADA Cybersecurity study guide

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products