A security analyst is reviewing network captures from a DNP3 link and notices a series of unsolicited responses from an RTU that contain unexpected object variations and function codes that are not part of the normal baseline. What does this pattern most likely indicate?

An attacker is attempting to exploit DNP3 parser vulnerabilities by sending malformed or unexpected messages to the master station.

The master station has a misconfigured DNP3 address that is causing it to receive messages from a different RTU.

The RTU is experiencing a normal firmware update that changes its message format temporarily.

The RTU is sending heartbeat messages that are not documented in the baseline because they are only sent during daylight saving time changes.

An ICS security analyst is setting up anomaly detection for a DNP3 network. The analyst wants to detect a man-in-the-middle attack where an attacker is replaying previously captured DNP3 messages to the master station. Which monitoring technique is most effective for this specific attack?

Monitor DNP3 sequence numbers and challenge-response counters for unexpected resets or repeats.

Use a network TAP to capture all traffic and compare the source MAC addresses of DNP3 packets to a known-good list.

Monitor for any DNP3 traffic on the network, since all DNP3 traffic is suspicious.

Set an alert for any DNP3 message that contains a function code that is not in the top 10 most common function codes.

Which of the following is a common method to add encryption and authentication to Modbus TCP communications?

Using a serial cable instead of Ethernet

Enabling the built-in AES encryption in Modbus TCP

Tunneling Modbus TCP over a VPN (e.g., IPsec or TLS)

Setting a password on the Modbus master

Which of the following is an anomaly detection technique specifically applicable to DNP3 traffic?

Monitoring the temperature of the DNP3 master station

Counting the number of DNP3 devices in the rack

Monitoring for unexpected changes in DNP3 object point values or control commands

Analyzing the color of the DNP3 status LEDs on the RTU

Which of the following is a protocol-specific security control for DNP3 that adds authentication to the protocol?

DNP3 Secure Authentication (SAv5)

EC-CouncilICS/SCADA Cybersecurity

Domain 6Objective 3

Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 7)

Part of the Securing the ICS Network domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

Questions 31–35

31application · medium
A security analyst is reviewing network captures from a DNP3 link and notices a series of unsolicited responses from an RTU that contain unexpected object variations and function codes that are not part of the normal baseline. What does this pattern most likely indicate?
Select an answer first
32application · medium
An ICS security analyst is setting up anomaly detection for a DNP3 network. The analyst wants to detect a man-in-the-middle attack where an attacker is replaying previously captured DNP3 messages to the master station. Which monitoring technique is most effective for this specific attack?
Select an answer first
33foundation · easy
Which of the following is a common method to add encryption and authentication to Modbus TCP communications?
Select an answer first
34foundation · easy
Which of the following is an anomaly detection technique specifically applicable to DNP3 traffic?
Select an answer first
35foundation · easy
Which of the following is a protocol-specific security control for DNP3 that adds authentication to the protocol?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.