A security analyst captures traffic on a control network and sees a series of Modbus TCP write requests to a PLC's holding registers from an IP address that is not in the list of known HMIs. The requests are all successful. What is the most immediate security concern?

The PLC is broadcasting its register values to the entire network.

The protocol lacks authentication, so any host that can reach the PLC can issue writes.

The analyst's packet capture tool is misconfigured and is showing spoofed source IPs.

The PLC is using an outdated firmware version that is vulnerable to a known exploit.

Which of the following best describes the difference between serial and Ethernet variants of ICS/SCADA protocols?

Serial variants use RS-232/RS-485 and have lower bandwidth, while Ethernet variants use TCP/IP and offer higher bandwidth and integration

Serial variants are always more secure than Ethernet variants

Serial variants support peer-to-peer communication, while Ethernet variants only support master/slave

Ethernet variants are only used for wireless communication

A security analyst is investigating a suspected intrusion on a DNP3 network. The analyst has a pcap that shows a master sending a 'Cold Restart' command to an outstation, followed by a series of 'Write' requests to the outstation's configuration object. The outstation's responses show 'IIN' bits indicating 'Device Restart' and 'Configuration Corrupt'. The analyst also notices that the master's source address is the same as the legitimate master, but the link-layer address is different. What is the most likely conclusion?

An attacker is spoofing the master's address to reconfigure the outstation.

The outstation is malfunctioning and resetting itself, causing configuration corruption.

The legitimate master is performing routine maintenance on the outstation.

The network has a duplicate IP address issue causing the master's traffic to be misrouted.

EC-CouncilICS/SCADA Cybersecurity

Domain 2Objective 6

ICS/SCADA Protocols ICSSCADA Practice Questions (Page 1)

Part of the TCP/IP and ICS/SCADA Protocols domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1foundation · easy
Which ICS/SCADA protocol is widely used in building automation and industrial control systems, operates over serial lines or Ethernet, and uses a master/slave model?
Select an answer first
2application · medium
A water treatment facility uses a legacy serial Modbus RTU network to connect PLCs to a central SCADA server. The plant engineer wants to migrate to Ethernet while preserving the existing PLC programming and register mappings. Which protocol should be selected to minimize reconfiguration effort?
Select an answer first
3application · medium
A security analyst captures traffic on a control network and sees a series of Modbus TCP write requests to a PLC's holding registers from an IP address that is not in the list of known HMIs. The requests are all successful. What is the most immediate security concern?
Select an answer first
4foundation · easy
Which of the following best describes the difference between serial and Ethernet variants of ICS/SCADA protocols?
Select an answer first
5expert · hard
A security analyst is investigating a suspected intrusion on a DNP3 network. The analyst has a pcap that shows a master sending a 'Cold Restart' command to an outstation, followed by a series of 'Write' requests to the outstation's configuration object. The outstation's responses show 'IIN' bits indicating 'Device Restart' and 'Configuration Corrupt'. The analyst also notices that the master's source address is the same as the legitimate master, but the link-layer address is different. What is the most likely conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.

ICS/SCADA Protocols ICSSCADA Practice Questions (Page 1)

Questions 1–5

Which ICS/SCADA protocol is widely used in building automation and industrial control systems, operates over serial lines or Ethernet, and uses a master/slave model?

A water treatment facility uses a legacy serial Modbus RTU network to connect PLCs to a central SCADA server. The plant engineer wants to migrate to Ethernet while preserving the existing PLC programming and register mappings. Which protocol should be selected to minimize reconfiguration effort?

A security analyst captures traffic on a control network and sees a series of Modbus TCP write requests to a PLC's holding registers from an IP address that is not in the list of known HMIs. The requests are all successful. What is the most immediate security concern?

Which of the following best describes the difference between serial and Ethernet variants of ICS/SCADA protocols?

Keep studying — TCP/IP and ICS/SCADA Protocols