Free ICS-SCADA sample questions

Correct answer: Perform a list scan (`-sL`) followed by a ping scan (`-sn`).

In sensitive ICS environments, active port scanning can crash fragile TCP/IP stacks on legacy devices. The safest approach is to use passive or minimally invasive techniques. A list scan (`-sL`) simply resolves hostnames without sending any packets to the targets. A ping scan (`-sn`) only checks for host liveness using methods like ARP requests on a local network, which is generally safer than port scanning. This two-step approach identifies live hosts with minimal interaction, reducing the risk of disruption. TCP Connect scans and UDP scans are more intrusive and carry a higher risk.

Correct answer: Temporal Metrics

The Temporal Metrics in CVSS are used to adjust the Base Score based on factors that change over time, such as the availability of exploit code, official patches, and the confidence in the vulnerability report. In this scenario, the availability of a patch (Remediation Level) and the current state of exploitability (Exploit Code Maturity) are both components of the Temporal metric group, which gives a more accurate picture of the current risk than the static Base Score alone.

Correct answer: False

This statement is false. NIST SP 800-82 and general ICS security principles emphasize that the priority of security objectives in ICS/OT environments is the reverse of traditional IT. For ICS, the primary concern is availability and system integrity to ensure safe and continuous physical processes. Confidentiality is typically the lowest priority. The correct priority for ICS is often cited as Availability, Integrity, and then Confidentiality (AIC).

Correct answer: Install a hardware-based data diode between the Level 3 network and a replica historian server in the Industrial DMZ.

A data diode is a hardware device that physically enforces a one-way data flow, making it impossible for traffic to travel from the less secure enterprise network back into the more secure control network. This provides the highest level of segmentation and security against threats originating from the IT side. While a firewall, jump server, or mirrored servers in a DMZ provide good security, they are software-based controls that can still be misconfigured or compromised, potentially allowing two-way traffic. The data diode offers a physically guaranteed unidirectional path.

Correct answer: An ICS-aware Network Security Monitoring (NSM) platform with deep packet inspection for industrial protocols.

An ICS-aware Network Security Monitoring (NSM) platform is specifically designed to passively monitor and analyze industrial network traffic. It uses deep packet inspection (DPI) to understand protocols like DNP3 and Modbus, allowing it to detect anomalous or malicious commands, such as unauthorized stop commands or firmware updates. A traditional IT NIDS lacks this protocol-specific knowledge. A HIDS only protects the host it's on and doesn't provide network-wide visibility. A SIEM requires log sources and doesn't directly analyze packet captures from a SPAN port for this purpose.

Correct answers: Impair Process Control; Inhibit Response Function

Correct answer: Implement strict network segmentation and firewall rules to limit access to the SCADA server to only authorized operator workstations.

Since the underlying vulnerability (weak hashing) cannot be fixed, the most effective compensating control is to prevent unauthorized access to the server and the password file itself. Strict network segmentation, using firewalls to create a secure enclave around the SCADA server, and limiting access to only a few hardened operator workstations dramatically reduces the attack surface. This prevents an attacker from ever reaching the server to obtain the password file. While password policies are good practice, they don't fix the weak hashing, which allows even complex passwords to be cracked quickly if the hash file is stolen.

Correct answer: Write Multiple Registers

In the Modbus protocol, function codes define the action to be performed. Function code 16 (decimal) corresponds to the 'Write Multiple Registers' command. This command is used to write a block of contiguous holding registers in a remote device. This is a common operation for sending a set of new parameters or setpoints to a PLC.

Correct answer: MMS (Manufacturing Message Specification)

Within the IEC 61850 standard, MMS is the client-server protocol used for a variety of functions, including reporting, control, and crucially, discovering the data model and reading/writing data points on an IED. An attacker would use MMS to enumerate the logical nodes, data objects, and data attributes of the IEDs to understand the process and plan further attacks. GOOSE and SV are typically used for high-speed peer-to-peer messaging and are not suitable for enumeration.

Correct answer: `auxiliary/scanner/bacnet/discover_properties`

Metasploit auxiliary modules are used for reconnaissance, scanning, and enumeration rather than direct exploitation. The `auxiliary/scanner/bacnet/discover_properties` module is specifically designed to query a BACnet device and enumerate its objects and properties, including identifying which ones are writable. This is a critical step in a penetration test to find points that can be manipulated.