Free EC-Council ICS/SCADA Cyber Security ICS-SCADA Exam Questions

An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious activities or policy violations and can perform several functions:

Monitor: Observing network traffic and system activities for unusual or suspicious behavior.

Detect: Identifying potential security breaches including both known threats and unusual activities that could indicate new threats.

Respond: Executing pre-defined actions to address detected threats, which can include alerts or triggering automatic countermeasures. Reference:

Cisco Systems, 'Intrusion Detection Systems'.

The WannaCry ransomware primarily exploited vulnerabilities in the SMB (Server Message Block) version 1 protocol to propagate across network systems. Microsoft had identified vulnerabilities in SMBv1, which were exploited by the EternalBlue exploit to spread the ransomware. This led to widespread infections, particularly in systems that had not applied the security updates released to patch the vulnerability. Reference:

Microsoft Security Bulletin MS17-010, 'Security Update for Microsoft Windows SMB Server'.

Ingress filtering is a method used in network security to ensure that incoming packets are allowed or blocked based on a set of security rules.

This type of filtering is often implemented at the boundaries of networks to prevent unwanted or harmful traffic from entering a more secure internal network.

The term 'ingress' refers to traffic that is entering a network boundary, whereas 'egress' refers to traffic exiting a network.

Reference

Cisco Networking Academy Program: Network Security.

'Understanding Ingress and Egress Filtering,' Network Security Guidelines, TechNet.

The term 'Dropper' in cybersecurity refers to a small piece of software used in malware deployment that is designed to install or 'drop' malware (like viruses, ransomware, spyware) onto the target system.

The Dropper itself is not typically malicious in behavior; however, it is used as a vehicle to install malware that will perform malicious activities without detection.

During the infection process, the Dropper is usually the first executable that runs on a system. It then unpacks or downloads additional malicious components onto the system.

Reference

Common Malware Enumeration (CME): http://cme.mitre.org

Microsoft Malware Protection Center: https://www.microsoft.com/en-us/wdsi

In ICS/SCADA systems, the typical priority hierarchy of the IT Security Model components places Availability and Integrity above Confidentiality. This prioritization is due to the critical nature of operational continuity and data accuracy in industrial control systems, where system downtime or incorrect data can lead to significant operational disruptions or safety issues. Confidentiality, while important, is often considered of lesser priority compared to ensuring systems are operational (Availability) and data is accurate (Integrity). Reference:

National Institute of Standards and Technology (NIST), 'Guide to Industrial Control Systems (ICS) Security'.

The Wayback Machine is an internet service provided by the Internet Archive that allows users to see archived versions of web pages across time, enabling them to browse past versions of a website as it appeared on specific dates.

It captures and stores snapshots of web pages, making it an invaluable tool for accessing the historical state of a website or recovering content that has since been changed or deleted.

Other options like Google Cache may also show snapshots of web pages, but the Wayback Machine is dedicated to this purpose and holds a vast archive of historical web data.

Reference

Internet Archive: https://archive.org

'Using the Wayback Machine,' Internet Archive Help Center.

A masquerade attack involves an attacker pretending to be an authorized user of a system, thus compromising the authentication component of the IT security model. Authentication ensures that the individuals accessing the system are who they claim to be. By masquerading as a legitimate user, an attacker can bypass this security measure and gain unauthorized access to the system. Reference:

William Stallings, 'Security in Computing'.

The Common Vulnerability Scoring System (CVSS) is a framework for rating the severity of security vulnerabilities. CVSS provides three main score areas: Base, Temporal, and Environmental.

Base Score evaluates the intrinsic qualities of a vulnerability.

Temporal Score reflects the characteristics of a vulnerability that change over time.

Environmental Score considers the specific impact of the vulnerability on a particular organization, tailoring the Base and Temporal scores according to the importance of the affected IT asset. Reference:

FIRST, 'Common Vulnerability Scoring System v3.1: Specification Document'.

Code Red is not ICS specific malware; it was a famous worm that targeted computers running Microsoft's IIS web server. Unlike Flame, Havex, and Stuxnet, which were specifically designed to target industrial control systems or perform espionage related to ICS environments, Code Red was aimed at exploiting vulnerabilities in internet-facing software to perform denial-of-service attacks and other malicious activities. Reference:

CERT Coordination Center, 'Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL'.

The protocol number 6 represents TCP (Transmission Control Protocol) in the Internet Protocol suite. TCP is a core protocol of the Internet Protocol suite and operates at the transport layer, providing reliable, ordered, and error-checked delivery of a stream of bytes between applications running on hosts communicating via an IP network. Reference:

RFC 793, 'Transmission Control Protocol,' which specifies the detailed operation of TCP.