Which monitoring technique is commonly used to detect anomalies in Modbus TCP traffic?

Monitoring only the CPU temperature of the PLC

Counting the number of physical network cables

Deep packet inspection (DPI) of Modbus function codes and register addresses

Checking the color of the Ethernet cables

When deploying Modbus TCP in a new ICS network, which of the following is a secure deployment practice?

Enable the built-in encryption option in the Modbus TCP configuration

Place all Modbus devices on the same flat network segment to simplify communication

Segment the Modbus network using firewalls and allow only necessary traffic to and from specific IP addresses

Use default passwords for all Modbus devices to ensure compatibility

A power utility is upgrading its DNP3 network. The new RTUs support DNP3 Secure Authentication with pre-shared keys, but the existing master station software does not support it. The utility cannot upgrade the master station for another year. The security team must protect the DNP3 traffic from tampering and replay in the interim. What is the best approach?

Configure the RTUs to use a different protocol, such as Modbus TCP, which is more secure.

Deploy an inline DNP3 security gateway that terminates the DNP3 session and adds authentication and integrity checking before forwarding to the master station.

Use a VPN tunnel between the RTU and the master station to provide encryption and integrity.

Disable DNP3 Secure Authentication on the RTUs and rely on the physical security of the network.

Which of the following is a built-in security feature of OPC UA that provides authentication and encryption?

A proprietary encryption algorithm developed by the vendor

A shared password stored in the PLC

X.509 certificates and security policies

Which of the following is a secure deployment practice for OPC UA in an industrial network?

Use OPC Classic (COM/DCOM) instead because it is simpler

Use OPC UA's built-in security features, such as application authentication and message signing

Expose OPC UA servers directly to the internet for remote monitoring

Disable all security policies to maximize performance

EC-CouncilICS/SCADA Cybersecurity

Domain 6Objective 3

Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 1)

Part of the Securing the ICS Network domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

Questions 1–5

1foundation · easy
Which monitoring technique is commonly used to detect anomalies in Modbus TCP traffic?
Select an answer first
2foundation · easy
When deploying Modbus TCP in a new ICS network, which of the following is a secure deployment practice?
Select an answer first
3expert · hard
A power utility is upgrading its DNP3 network. The new RTUs support DNP3 Secure Authentication with pre-shared keys, but the existing master station software does not support it. The utility cannot upgrade the master station for another year. The security team must protect the DNP3 traffic from tampering and replay in the interim. What is the best approach?
Select an answer first
4foundation · easy
Which of the following is a built-in security feature of OPC UA that provides authentication and encryption?
Select an answer first
5foundation · easy
Which of the following is a secure deployment practice for OPC UA in an industrial network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.