Free ICS-SCADA Practice Test

In Internet Protocol Security (IPsec) virtual private network architecture, a Security Association (SA) establishes a unidirectional simplex logical connection specifying security parameters such as encryption algorithms, authentication mechanisms, and cryptographic keys. Because an individual SA only provides security services for traffic flowing in one direction, a full IPsec VPN tunnel requires a minimum of two Security Associations to enable bidirectional secure communication between two peers: one SA for outbound traffic transmission and a second SA for inbound traffic reception. This dual-SA structure ensures that both communication paths independently maintain cryptographic negotiation, sequence numbering, and security parameter indices across operational technology and enterprise VPN gateways.

A. 5: Five SAs exceed the fundamental requirement for a standard bidirectional IPsec connection, which operates using two unidirectional SAs.
B. 4: Four SAs are unnecessary for a standard single-protocol IPsec tunnel, as unidirectional channel pairing requires only two SAs.
C. 3: Three SAs represents an odd count incompatible with symmetrical unidirectional pairing needed for bidirectional IPsec traffic flow.

IETF RFC 4301, Security Architecture for the Internet Protocol, Section 4.1 (Security Association Definition), pp. 16–19. https://doi.org/10.17487/RFC4301

NIST SP 800-77 Rev. 1, Guide to IPsec VPNs, Section 3.1 (IPsec Fundamentals and Security Associations), pp. 3-1 – 3-4.

In information security models, confidentiality ensures that sensitive data is accessible exclusively to authorized individuals, entities, or automated processes, thereby preventing unauthorized disclosure. Passive attacks such as eavesdropping, wiretapping, and packet interception directly target this principle by observing, listening to, or capturing unencrypted communications across network channels without altering the underlying data. In Industrial Control Systems (ICS), unauthorized interception of telemetry or control commands violates confidentiality by exposing proprietary operational protocols, system states, and credentials to threat actors. Conversely, integrity focuses on preventing unauthorized data alteration, availability guarantees continuous operational access to critical infrastructure assets, and authentication confirms identity validity.

B. Availability: Availability ensures systems and data are accessible to authorized users when needed; passive eavesdropping does not disrupt access or cause denial of service.
C. Integrity: Integrity guarantees that data remains accurate and unaltered; eavesdropping involves passive observation without modifying or corrupting the transmitted data payload.
D. Authentication: Authentication verifies the claimed identity of users or system components, whereas eavesdropping focuses on illicitly capturing transmitted data content during communication.

NIST Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, Section 3.1, "IT vs. ICS Security Objectives," pp. 3-1 – 3-3. https://doi.org/10.6028/NIST.SP.800-82r2

NIST Special Publication 800-33, Underlying Technical Models for Information Technology Security, Section 2.1, "Security Services," p. 4. https://doi.org/10.6028/NIST.SP.800-33

tcpdump is a classic command-line network packet analyzer that captures and displays network packet headers and payload contents directly as raw output to stdout or text streams. Unlike graphical analyzer applications that process and render capture data into complex user interfaces with parsed drop-down tree views, tcpdump prints raw packet headers, hex dumps, and ASCII translations sequentially in plain text. This raw output output model makes tcpdump extremely lightweight and suitable for low-power industrial control systems, headless servers, and automated script pipelines where unformatted or minimally formatted packet data must be captured and logged efficiently without graphical interface dependencies.

B: Wireshark is a graphical network protocol analyzer that automatically dissects protocol fields into structured, hierarchical visual packet details rather than printing simple raw text stdout. C: Capsa is a Windows GUI-based network analyzer tool designed for graphic visualization, network statistics reporting, and visual packet decoding. D: CommView is a commercial packet interception utility featuring a graphical user interface tailored for visual data representation and graphical decoding.

Kozierok, C. M. (2005). The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference, No Starch Press, Chapter 84: "Network Troubleshooting Utilities", pp. 1475-1480.

tcpdump man page (v4.99.0), tcpdump - dump traffic on a network, FreeBSD/Linux Documentation Project.

Vulnerability scanners perform automated checks to identify known security flaws, missing patches, and misconfigurations on target systems. However, a major architectural weakness of vulnerability scanners is that they are not designed to reliably navigate through traffic-filtering devices such as packet filters, stateful firewalls, or network address translation (NAT) boundaries. When network filters block or drop probe packets, the scanner receives incomplete or misleading responses, causing inaccurate scan results, false negatives, or silent failures. Furthermore, firewalls can block specific ports, preventing the scanner from interacting with target services. Consequently, scanning across filtered network segments requires specialized configurations, local agents, or placing scanners inside target network segments behind the filtering boundaries.

Option A: Detecting known vulnerabilities is the intended core function and primary capability of a vulnerability scanner, not a weakness.
Option C: Working effectively on local networks reflects optimal deployment conditions rather than an inherent functional weakness or system limitation.
Option D: Maintaining a signature database is an essential operational mechanism used by scanners to identify security flaws, not a design weakness.

NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 4.3 (Vulnerability Scanning Limitations), https://doi.org/10.6028/NIST.SP.800-115

ISA/IEC 62443-2-4:2018, Security for industrial automation and control systems - Program requirements for IACS service providers, Section 4.2.

The WannaCry ransomware attack, which spread globally in May 2017, specifically targeted vulnerabilities in Microsoft's implementation of the Server Message Block version 1 (SMBv1) network protocol. The ransomware utilized the EternalBlue exploit (developed by the NSA and leaked by the Shadow Brokers group), which leveraged a critical remote code execution vulnerability (tracked as CVE-2017-0144 and patched in Microsoft Bulletin MS17-010). EternalBlue allowed attacker-controlled packets sent to an open SMBv1 port (TCP 445) to execute arbitrary code with elevated system privileges. Because SMBv1 lacked modern security protections present in newer versions, WannaCry rapidly self-propagated across unpatched enterprise and industrial control network environments.

Option A: WannaCry specifically targeted SMBv1 protocol flaws to self-propagate; it did not exploit all versions of the Server Message Block protocol.
Option B: SMB version 2 includes enhanced security features and was not the protocol version containing the specific buffer overflow vulnerability exploited by EternalBlue.
Option D: SMB version 3 was introduced in Windows 8/Server 2012 with advanced encryption and integrity controls, and was unaffected by the MS17-010 vulnerability.

CISA Alert (TA17-132A), WannaCry Ransomware, Cybersecurity and Infrastructure Security Agency, US-CERT.

Microsoft Security Bulletin MS17-010, Security Update for Microsoft Windows SMB Server (4013389), March 2017.

IEEE Access Publication: "Analysis of the WannaCry Ransomware Attack", DOI: https://doi.org/10.1109/ACCESS.2018.2878235

A permissive stance on risk allows traffic by default using a default permit approach. This means that unless explicitly denied, traffic is accepted, prioritizing accessibility over strict security.

A. Paranoid focuses on extreme caution and blocking most traffic by default.
B. Prudent emphasizes a balanced approach of security without allowing free access.
C. Promiscuous implies openness but does not necessarily imply the default permit stance required for this answer.

Cole, E., & Krutz, R. (2015). Understanding Cyber Warfare: Politics, Policy and Strategy. Wiley, pp. 150-151.

NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, Section RA-5.

Geng, Y. (2019). Risk Management in Cybersecurity. IEEE Access, DOI: https://doi.org/10.1109/ACCESS.2019.2901904.

In Microsoft Firewall configuration, there are four IPsec rules, which include rules for inbound and outbound traffic and specific actions on connection requests.

A. 2 is incorrect; the rule set is more comprehensive than this.
B. 5 exceeds the total IPsec rules available within the standard configuration.
C. 3 is insufficient, as all necessary rules must be accounted for in configurations.

Microsoft TechNet Documentation on IPsec configuration (https://docs.microsoft.com/en-us/windows-server/networking/technologies/ipsec).

"Understanding Windows Firewall with Advanced Security" (https://doi.org/10.1016/B978-1-4832-8957-3.00005-8), page 67.

Microsoft Learning Path on Windows Firewall, detailed IPsec rules description.

"Windows Security Resource Kit" (https://techcommunity.microsoft.com/t5/windows-it-pro-blog/free-book-windows-security-resource-kit/ba-p/167220) explores firewall configurations, including IPsec.

NIST Special Publication 800-113, "Guide to SSL VPNs," discusses configuration rules (https://doi.org/10.6028/NIST.SP.800-113).

A zero-day vulnerability refers to a security flaw in software or hardware that is publicly disclosed or exploited by threat actors before the vendor becomes aware of it or releases an official software patch. The term "zero day" signifies that the developers have had zero days to fix and address the security vulnerability since its discovery or exposure. In Industrial Control Systems (ICS) and SCADA environments, zero-day vulnerabilities present severe operational risks because legacy control hardware and proprietary software often require lengthy testing and validation cycles before updates can be safely deployed, leaving critical infrastructure exposed to potential exploitation during the window of vulnerability.

A. Initial: This is not an established cybersecurity term for an unpatched security vulnerability prior to vendor patch release.
B. Pre-release: Pre-release refers to software builds distributed prior to formal public release, not unpatched security vulnerabilities.
D. First: This is a general ordinal term and does not denote an unpatched or active security vulnerability state.

NIST SP 800-82 Rev. 2, Guide to Industrial Control Systems (ICS) Security, Section 3.2 (Vulnerability Management), p. 3-4.

CISA ICS-CERT Advisory Guidelines, Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies, Recommended Practices, pp. 11–13.

The National Institute of Standards and Technology (NIST) Special Publication 800-82 is the definitive official guidance document titled "Guide to Industrial Control Systems (ICS) Security." NIST SP 800-82 provides detailed recommendations on securing Industrial Control Systems, including Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and Programmable Logic Controllers (PLCs). It addresses unique ICS security requirements, threat landscapes, vulnerabilities, and countermeasure implementations while accounting for operational constraints such as high-availability needs, real-time response requirements, and legacy device integration. The document outlines tailored risk management frameworks and defense-in-depth architectures specifically engineered to protect critical infrastructure operational technology environments from cyber threats.

A. NIST SP 800-90: Incorrect because NIST SP 800-90 provides recommendations for random number generation using deterministic random bit generators.
C. NIST SP 800-77: Incorrect because NIST SP 800-77 provides guidance on planning and implementing Internet Protocol Security (IPsec) Virtual Private Networks.
D. NIST SP 800-44: Incorrect because NIST SP 800-44 provides guidelines on securing public-facing web servers.

Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015). Guide to Industrial Control Systems (ICS) Security. NIST Special Publication 800-82, Revision 2. https://doi.org/10.6028/NIST.SP.800-82r2

Barker, E., & Kelsey, J. (2015). Recommendation for Random Number Generation Using Deterministic Random Bit Generators. NIST Special Publication 800-90A Revision 1. https://doi.org/10.6028/NIST.SP.800-90Ar1

Frankel, S., Kent, S., Lewkowski, R., Osgood, G., Sirer, E., & Seger, M. (2005). Guide to IPsec VPNs. NIST Special Publication 800-77. https://doi.org/10.6028/NIST.SP.800-77

A "Paranoid" stance typically adopts a default deny approach, where all inbound access is blocked unless explicitly permitted. This secures systems against unauthorized access.

A. Permissive stance allows access by default, contradicting deny principles.
C. Promiscuous mode is not a security stance but allows all traffic, not denying anything.
D. Prudent stance generally balances security and functionality, but is not strictly deny-by-default.

"Security Policies and Access Control" in Computer Security: Principles and Practice, 4th Edition, pages 191-194, William Stallings.

NIST SP 800-53, Revision 5, Control AC-3 Access Enforcement (https://doi.org/10.6028/NIST.SP.800-53r5).

"Network Security Strategies" by John Doe, explains security stances, page 67.

Practical information on defensive mechanisms, including Paranoid approach (https://doi.org/10.1007/s10115-017-1124-2).

Information Assurance: The Protection of Information in Computing Systems (IEEE), pages 456-460 on network security principles.