ICS-SCADA Exam Questions & Answers

The IT Security Model commonly refers to the CIA Triad, which stands for Confidentiality, Integrity, and Availability.

An attack on 'Availability' is aimed at disrupting the normal functioning and access to data or resources in a network. This type of attack can include actions such as DDoS (Distributed Denial of Service), where overwhelming traffic is sent to a system to make it unresponsive.

The main goal of attacks on availability is to prevent legitimate users from accessing systems or information, which can have significant implications for business operations and security.

Reference

Understanding the CIA Triad in Cybersecurity: https://www.cyber.gov.au/acsc/view-all-content/publications/cia-triad

Denial of Service -- What it is and how to prevent it: https://www.us-cert.gov/ncas/tips/ST04-015

A data diode is known as a prebuilt directional gateway that is unidirectional, designed specifically to allow data to travel in only one direction, ensuring secure one-way communication. This feature makes data diodes ideal for environments where it is critical to prevent any possibility of data leakage or unauthorized access from an external network back to a secure network. Data diodes are commonly used in military and industrial applications, including ICS/SCADA systems, to protect sensitive information. Reference:

A Network Intrusion Prevention System (NIPS) is capable of monitoring and validating encrypted data if it is integrated with technologies that allow it to decrypt the traffic.

Typically, network IPS can be set up with SSL/TLS decryption capabilities to inspect encrypted data as it traverses the network. This allows the IPS to analyze the content of encrypted packets and apply security policies accordingly.

Monitoring encrypted traffic is critical in detecting hidden malware, unauthorized data exfiltration, and other security threats concealed within SSL/TLS encrypted sessions.

Reference

'Network Security Technologies and Solutions,' by Yusuf Bhaiji, Cisco Press.

'Decrypting SSL/TLS Traffic with IPS,' by Palo Alto Networks.

Modbus RTU (Remote Terminal Unit) is a communication protocol based on a master-slave architecture that uses serial communication. It is one of the earliest communication protocols developed for devices connected over serial lines. Modbus RTU packets are transmitted in a binary format over serial lines such as RS-485 or RS-232. Reference:

Modbus Organization, 'MODBUS over Serial Line Specification and Implementation Guide V1.02'.

In the Transmission Control Protocol (TCP) header, the sequence number field is crucial for ensuring the correct sequencing of the packets sent over a network.

The sequence number field in the TCP header is 32 bits long, which equates to 4 bytes.

This sequence number is used to keep track of the bytes in a sequence that are transferred over a TCP connection, ensuring that packets are arranged in the correct order and data integrity is maintained during transmission.

Reference

Postel, J., 'Transmission Control Protocol,' RFC 793, September 1981.

'TCP/IP Guide,' Kozierok, C. M., 2005.