A security engineer is developing a threat model for a new wind farm SCADA system. The engineer wants to understand how an attacker might systematically approach the system. Which framework best describes the attacker's likely methodology?

The NIST SP 800-82 guide, which provides ICS security guidance.

The MITRE ATT&CK for ICS framework, which maps tactics and techniques.

The ISO 27001 standard, which specifies information security management.

The OSI model, which describes network layers.

An attacker has gained access to the engineering workstation of a power utility and wants to manipulate the settings of a protective relay. The relay uses Modbus TCP and has no authentication. What is the most direct way for the attacker to achieve this?

Upload a new firmware image via TFTP to the relay.

Use ARP spoofing to intercept traffic between the relay and the SCADA server.

Send Modbus function code 0x10 (Write Multiple Registers) to the relay's holding registers.

Exploit a buffer overflow in the relay's web server to gain a shell.

What is the primary goal of the exploitation phase in hacking an ICS/SCADA system?

To gather information about the target network

To cover tracks and remove evidence

To maintain persistent access after the attack

To gain unauthorized access to the target system

A penetration tester is documenting the steps taken during an assessment of a food processing plant. The tester wants to present the findings in a way that maps each action to the hacking process phases. Which sequence correctly represents the hacking process?

Maintaining access, footprinting, scanning, exploitation, covering tracks.

Exploitation, scanning, footprinting, maintaining access, covering tracks.

Footprinting, scanning, enumeration, exploitation, maintaining access, covering tracks.

Scanning, footprinting, exploitation, covering tracks, maintaining access.

A threat actor has compromised a PLC in a chemical plant and wants to remain undetected while maintaining the ability to return. Which technique is most aligned with the 'maintaining access' phase of the hacking methodology?

Delete all event logs from the engineering workstation.

Install a backdoor in the PLC's firmware that re-establishes a connection to a command-and-control server on reboot.

Change the PLC's IP address to a different subnet.

Send a single Modbus write command to change a setpoint.

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 1

Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 6)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 26–30

26application · medium
A security engineer is developing a threat model for a new wind farm SCADA system. The engineer wants to understand how an attacker might systematically approach the system. Which framework best describes the attacker's likely methodology?
Select an answer first
27application · medium
An attacker has gained access to the engineering workstation of a power utility and wants to manipulate the settings of a protective relay. The relay uses Modbus TCP and has no authentication. What is the most direct way for the attacker to achieve this?
Select an answer first
28foundation · easy
What is the primary goal of the exploitation phase in hacking an ICS/SCADA system?
Select an answer first
29application · medium
A penetration tester is documenting the steps taken during an assessment of a food processing plant. The tester wants to present the findings in a way that maps each action to the hacking process phases. Which sequence correctly represents the hacking process?
Select an answer first
30application · medium
A threat actor has compromised a PLC in a chemical plant and wants to remain undetected while maintaining the ability to return. Which technique is most aligned with the 'maintaining access' phase of the hacking methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.