TCP/IP Protocol Architecture ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In TCP/IP, what does a socket consist of?

   • AA hostname and a MAC address
   • BA MAC address and an IP address
   • CA protocol type and a port number
   • DAn IP address and a port number
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing firewall logs and sees a connection from an external IP to a SCADA server on port 502. The analyst knows that port 502 is used for Modbus TCP. Which socket pair would the analyst expect to see in the log for this connection?

   • AExternal IP:random source port → SCADA server IP:502
   • BSCADA server IP:502 → External IP:random source port
   • CExternal IP:random destination port → SCADA server IP:502
   • DExternal IP:502 → SCADA server IP:random destination port
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A technician is troubleshooting a communication failure between an HMI and a PLC. The HMI sends a Modbus TCP request. The technician captures packets on the PLC's network interface and sees the request, but the PLC does not respond. The technician checks the TCP/IP stack on the PLC and notices that the incoming frame is being processed. At which layer would the technician first expect to see the Ethernet frame stripped away to reveal the IP packet?

   • ATransport layer
   • BNetwork interface layer
   • CInternet layer
   • DApplication layer
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common vulnerability when TCP/IP is used in ICS/SCADA networks?

   • ATCP/IP automatically disables all security features on the network
   • BTCP/IP requires all devices to use the same operating system
   • CLack of built-in authentication and encryption in many industrial protocols
   • DTCP/IP cannot be used with firewalls or VLANs
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SCADA system uses a proprietary protocol that runs over TCP port 502. The network team wants to implement a firewall rule that allows only the HMI server to communicate with the PLCs. The PLCs are on a separate subnet. Which firewall rule is the most restrictive and correct?

   • AAllow all TCP traffic between the HMI server and PLC subnet.
   • BAllow UDP from HMI server IP to PLC subnet on destination port 502.
   • CAllow TCP from PLC subnet to HMI server IP on source port 502.
   • DAllow TCP from HMI server IP to PLC subnet on destination port 502.
   Reveal Solution Discussion Select an answer first