Important Eccouncil ICS-SCADA Exam Questions

Answer: C

Explanation:

The term 'Dropper' in cybersecurity refers to a small piece of software used in malware deployment that is designed to install or 'drop' malware (like viruses, ransomware, spyware) onto the target system.

The Dropper itself is not typically malicious in behavior; however, it is used as a vehicle to install malware that will perform malicious activities without detection.

During the infection process, the Dropper is usually the first executable that runs on a system. It then unpacks or downloads additional malicious components onto the system.

Reference

Common Malware Enumeration (CME): http://cme.mitre.org

Microsoft Malware Protection Center: https://www.microsoft.com/en-us/wdsi

Answer: A

Explanation:

ICMP (Internet Control Message Protocol) is used in network devices, like routers, to send error messages and operational information indicating success or failure when communicating with another IP address.

An ICMP type 8 packet specifically is an 'Echo Request.' It is used primarily by the ping command to test the connectivity between two nodes.

When a device sends an ICMP Echo Request, it expects to receive an ICMP Echo Reply (type 0) from the target node. This mechanism helps in diagnosing the state and reachability of a network on the Internet or within a private network.

Reference

RFC 792 Internet Control Message Protocol: https://tools.ietf.org/html/rfc792

Internet Assigned Numbers Authority (IANA) ICMP Parameters:

Answer: C

Explanation:

The WannaCry ransomware primarily exploited vulnerabilities in the SMB (Server Message Block) version 1 protocol to propagate across network systems. Microsoft had identified vulnerabilities in SMBv1, which were exploited by the EternalBlue exploit to spread the ransomware. This led to widespread infections, particularly in systems that had not applied the security updates released to patch the vulnerability. Reference:

Microsoft Security Bulletin MS17-010, 'Security Update for Microsoft Windows SMB Server'.

Answer: C

Explanation:

The third generation of ICS/SCADA systems is considered distributed. This generation features systems that are networked and interconnected, typically using a variety of standard communication protocols. This distribution allows for broader connectivity and integration with other systems, enhancing operational flexibility and efficiency but also introducing more vectors for potential cyber threats. Reference:

Joseph Weiss, 'Protecting Industrial Control Systems from Electronic Threats'.

The third generation of ICS/SCADA systems is considered distributed. These systems emerged in the late 1990s and early 2000s and were designed to overcome the limitations of earlier generations by leveraging networked architectures.

Distributed Architecture: Third-generation systems distributed control functions across multiple interconnected devices and systems, providing greater scalability and flexibility.

Network Integration: These systems integrated more extensively with IT networks, allowing for remote monitoring and control.

Standard Protocols: Adoption of standard communication protocols (e.g., Ethernet, TCP/IP) facilitated interoperability and integration with other systems.

Enhanced Redundancy: Improved fault tolerance and redundancy were implemented to ensure system reliability.

Due to these features, the third generation is known as the distributed generation.

Reference

'SCADA Systems,' SCADAHacker, SCADA Generations.

Answer: A

Explanation:

The Common Vulnerability Scoring System (CVSS) uses several metrics to assess the severity of vulnerabilities. Among them, the Temporal metric group specifically reflects the exploit quotient of a vulnerability.

Temporal metrics consider factors that change over time after a vulnerability is initially assessed. These include:

Exploit Code Maturity: This assesses the likelihood of the vulnerability being exploited based on the availability and maturity of exploit code.

Remediation Level: The level of remediation available for the vulnerability, which influences the ease of mitigation.

Report Confidence: This metric measures the reliability of the reports about the vulnerability.

These temporal factors directly affect the exploitability and potential threat posed by a vulnerability, adjusting the base score to provide a more current view of the risk.

Reference

Common Vulnerability Scoring System v3.1: User Guide.

'Understanding CVSS,' by FIRST (Forum of Incident Response and Security Teams).