EC-Council ICS/SCADA Cyber Security ICS-SCADA Exam Questions

Answer : C

In the context of monitoring and alerts within cybersecurity, the classification of alerts includes true positives, false positives, true negatives, and false negatives.

A false negative is considered the most dangerous type of alert because it occurs when an actual security threat is present but the monitoring system fails to detect and alert it. This allows malicious activities to occur undetected, potentially leading to significant damage or data loss.

The risk with false negatives is that they provide a false sense of security, assuming that systems are secure while in reality, they are compromised.

Reference

'Security and Network Monitoring Basics,' Cisco Systems.

'Understanding Alert Classifications in Cybersecurity,' Journal of Information Security.

Answer : B

NIST SP 800-53 is a publication that provides a catalog of security and privacy controls for federal information systems and organizations and promotes the development of secure and resilient federal information and information systems.

According to the NIST SP 800-53 Rev. 5, the framework defines a comprehensive set of controls, which are divided into different families. Among these families, there are specifically nine families categorized under management controls. These include categories such as risk assessment, security planning, program management, and others.

Reference

'NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for Information Systems and Organizations.'

NIST website: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Answer : C

Code Red is not ICS specific malware; it was a famous worm that targeted computers running Microsoft's IIS web server. Unlike Flame, Havex, and Stuxnet, which were specifically designed to target industrial control systems or perform espionage related to ICS environments, Code Red was aimed at exploiting vulnerabilities in internet-facing software to perform denial-of-service attacks and other malicious activities. Reference:

CERT Coordination Center, 'Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL'.

Answer : C

Modification attacks directly impact the integrity of data within the IT Security Model. Integrity ensures that information is accurate and unchanged from its original form unless altered by authorized means. An attack that involves modification manipulates data in unauthorized ways, thereby compromising its accuracy and reliability. Reference:

Shon Harris, 'CISSP Certification: All-in-One Exam Guide'.

Answer : A

Information management within the context of network security involves several critical functions that ensure data is correctly handled for security operations. These functions include:

Normalization: This process standardizes data formats from various sources to a common format, making it easier to analyze systematically.

Correlation: This function identifies relationships between disparate pieces of data, helping to identify patterns or potential security incidents.

Data enrichment: Adds context to the collected data, enhancing the information with additional details, such as threat intelligence.

All these functions are essential to effective information management in security systems, allowing for more accurate monitoring and faster response to potential threats.

Reference

'Data Enrichment and Correlation in SIEM Systems,' Security Information Management Best Practices.

'Normalization Techniques for Security Data,' Journal of Network Security.

Answer : D

The Authentication Header (AH) in the context of IPsec has a fixed header portion of 24 bits and a mutable part that can vary, but when considering the fixed structure of the AH itself, the width is typically considered to be 32 bits at its core structure for basic operations in providing integrity and authentication, without confidentiality. Reference:

RFC 4302, 'IP Authentication Header'.

Answer : A

ICMP (Internet Control Message Protocol) is used in network devices, like routers, to send error messages and operational information indicating success or failure when communicating with another IP address.

An ICMP type 8 packet specifically is an 'Echo Request.' It is used primarily by the ping command to test the connectivity between two nodes.

When a device sends an ICMP Echo Request, it expects to receive an ICMP Echo Reply (type 0) from the target node. This mechanism helps in diagnosing the state and reachability of a network on the Internet or within a private network.

Reference

RFC 792 Internet Control Message Protocol: https://tools.ietf.org/html/rfc792

Internet Assigned Numbers Authority (IANA) ICMP Parameters: