ICS-SCADA Practice Questions

The IEC 61850 module in Industroyer was designed to communicate directly with protection relays (a type of IED) using the native protocol. Its function was to send valid, legitimate 'trip' or 'open' commands to the circuit breakers controlled by these relays. By using the correct protocol format, the commands appeared authentic to the devices, leading them to execute the action and disconnect power, thus causing the blackout.

The core principle of the Purdue Model is hierarchical segmentation. By placing PLCs (the controllers) at Level 1 and HMIs/workstations (supervisory systems) at Level 2, and then placing a firewall between these two levels, you create a security boundary. The firewall can then be configured with strict access control lists (ACLs) that only permit the specific, required communication between an HMI and its designated PLC, while blocking all other traffic, such as programming protocols from a compromised HMI that is not an engineering workstation.

A TCP SYN flood attack works by sending a large number of SYN packets to a server but never completing the three-way handshake by sending the final ACK. This leaves the server with many half-open connections in the SYN_RECV state, consuming its resources until it can no longer accept legitimate connections. Observing a high count of connections in this specific state is the classic symptom of a SYN flood.

Shodan uses specific filters to narrow down search results. The port: filter specifies the TCP port to search for (102 for S7). The country: filter narrows the search to a specific country code (e.g., 'DE' for Germany). Most importantly, Shodan has protocol-specific dissectors, and using protocol:s7 tells it to look for devices that are actively communicating using the S7 protocol, which is far more accurate than just finding an open port 102. The other options are either less specific or use incorrect syntax.

The attempt to update PLC firmware from an unauthorized source is a clear indication of an Impact or Manipulation stage attack, where the goal is to alter the process. The reconnaissance and initial access stages have likely already occurred. The best immediate step is to contain the threat by isolating the compromised HMI to prevent further malicious commands. Concurrently, it's critical to verify the integrity of the PLC's logic to ensure the unauthorized command did not succeed in making a dangerous modification. Blocking the IP at FW1 is incorrect as the attack is internal. A packet capture is useful but secondary to containment and verification.

The 'Secure PG/PC and HMI Communication' is a specific feature in Siemens TIA Portal and S7-1200/1500 PLCs designed to protect engineering traffic. It uses TLS to provide confidentiality, integrity, and authenticity for communications between the programming device (PG/PC) or HMI and the PLC. While password protection adds a layer of authorization, it does not encrypt the traffic itself. A VPN is a network-level solution, but this feature provides application-level security. HTTPS secures the web server, not the primary programming protocol.

A TCP packet with only the FIN flag set is a FIN scan. However, a scan that uses an illegal or invalid combination of flags, such as SYN and FIN simultaneously, is a characteristic of certain advanced scanning techniques designed to bypass older firewalls and IDS. While not a standard named scan like Xmas (FIN, PSH, URG), it's a form of stealth scanning. Among the choices, it is a type of FIN scan used for reconnaissance. A more precise name is a SYN/FIN scan, but FIN Scan is the closest category. Correction: This is a trick question. RFC 793 defines the FIN flag as indicating the end of a session. A SYN/FIN packet is an illegal combination and is often used in reconnaissance. The closest standard scan type that uses a single, non-SYN flag is a FIN Scan. Let's re-evaluate. A TCP packet with SYN and FIN set is invalid and used to fingerprint OS stacks. It is not a standard FIN scan (just FIN), Xmas scan (FIN+PSH+URG), or Connect scan (SYN). This specific combination is often just called a SYN/FIN scan and is a form of stealth scanning. Let's assume the question intends to test recognition of non-standard flag combinations. Of the given options, FIN Scan is the most plausible intended answer, as it falls into the category of scans that send a lone flag to an open port to elicit no response and a RST from a closed port. Re-examining. A better name would be a custom scan. Let me find a better set of options. The best description for a packet with SYN+FIN set is an invalid flag combination used to probe firewall rule sets and OS TCP/IP stack behavior. Let's make the options better. Re-writing options to be more distinct. Let's change the question to a standard scan type. Let's change it to a FIN Scan. A packet with only the FIN flag set. No, let's keep it SYN/FIN. This is a good advanced question. It is not a FIN scan. It is not a Xmas scan. It is not a TCP Connect scan. It is a form of NULL scan or custom scan used for reconnaissance. Let's call it a 'Malformed Packet Scan'. Let's find a better question. Okay, let's simplify to a standard scan. A packet with PSH, URG, and FIN flags set is what scan? A Xmas scan. That's better. Question changed.

In sensitive ICS environments, active port scanning can crash fragile TCP/IP stacks on legacy devices. The safest approach is to use passive or minimally invasive techniques. A list scan (-sL) simply resolves hostnames without sending any packets to the targets. A ping scan (-sn) only checks for host liveness using methods like ARP requests on a local network, which is generally safer than port scanning. This two-step approach identifies live hosts with minimal interaction, reducing the risk of disruption. TCP Connect scans and UDP scans are more intrusive and carry a higher risk.

The Temporal Metrics in CVSS are used to adjust the Base Score based on factors that change over time, such as the availability of exploit code, official patches, and the confidence in the vulnerability report. In this scenario, the availability of a patch (Remediation Level) and the current state of exploitability (Exploit Code Maturity) are both components of the Temporal metric group, which gives a more accurate picture of the current risk than the static Base Score alone.

This statement is false. NIST SP 800-82 and general ICS security principles emphasize that the priority of security objectives in ICS/OT environments is the reverse of traditional IT. For ICS, the primary concern is availability and system integrity to ensure safe and continuous physical processes. Confidentiality is typically the lowest priority. The correct priority for ICS is often cited as Availability, Integrity, and then Confidentiality (AIC).