I85PREP
⌘ K
ICS/SCADA study materials
ICS/SCADA study resources

ICS/SCADA practice questions

One question at a time. Build your ICS/SCADA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to ICS/SCADA Network Defense

In the Purdue Enterprise Reference Architecture model, which level typically contains the Historian, Engineering Workstation, and SCADA servers for a process site?

  1. Level 0 (Process)
  2. Level 1 (Basic Control)
  3. Level 3 (Site Operations) Correct answer.
  4. Level 4 (Enterprise/IT)

Explanation

Level 3, the site operations level, hosts supervisory systems such as SCADA servers, historians, and engineering workstations that manage a process area. Level 0 is the physical process, Level 1 is basic controllers, and Level 4 is enterprise IT. This separation is what allows defenders to place controls at the boundary between operations and IT.

Question 2Introduction to ICS/SCADA Network Defense

A utility wants to block unauthorized traffic from the corporate network into its control network while still allowing approved data flows. Which control best matches the zone-and-conduit concept from IEC 62443?

  1. Flat VLAN spanning both networks with ACLs on each host
  2. A firewall or data diode enforcing a defined conduit between security zones Correct answer.
  3. Disabling all logging on the control network to reduce load
  4. Using the same domain credentials across both networks

Explanation

IEC 62443 zones group assets with common security requirements, and conduits are the controlled communication paths between zones. A firewall or data diode that enforces only approved flows is the practical implementation of a conduit. Flattening the network or sharing credentials removes the boundary the model is meant to create.

Question 3Introduction to ICS/SCADA Network Defense

Which protocol is a common industrial fieldbus that historically has no built-in authentication or encryption and therefore requires compensating network controls?

  1. IPsec
  2. SSH
  3. Modbus/TCP Correct answer.
  4. HTTPS

Explanation

Modbus/TCP is a widely deployed industrial protocol designed for simplicity, with no native authentication, integrity, or confidentiality. Defenders compensate with segmentation, monitoring, and protocol-aware filtering. The other options are security or transport protocols that provide encryption or authentication.

Question 4Introduction to ICS/SCADA Network Defense

An engineer notices that a PLC accepts write commands from any host on the plant VLAN. Which defense most directly reduces the impact of this weakness?

  1. Increase the PLC scan rate to detect writes faster
  2. Segment the plant VLAN and restrict who can reach the PLC with firewall rules Correct answer.
  3. Replace the PLC with a newer model that has more memory
  4. Add more HMI screens for operators to watch the process

Explanation

Because the PLC lacks command authentication, the practical mitigation is to limit network reachability so only authorized engineering hosts can send writes. Segmentation and firewall rules enforce that restriction. Faster scan rates, more memory, or extra HMI screens do not prevent unauthorized write commands.

Question 5Introduction to ICS/SCADA Network Defense

What is the primary purpose of a unidirectional gateway (data diode) in an ICS environment?

  1. To load-balance traffic across redundant PLCs
  2. To allow data to flow in only one direction, preventing inbound control traffic Correct answer.
  3. To encrypt all traffic between two control zones
  4. To translate Modbus into HTTPS for legacy devices

Explanation

A data diode physically enforces one-way communication, typically letting process data leave a secure zone while blocking any inbound path. This protects the control network from commands or malware originating on the other side. It does not encrypt, balance load, or perform protocol translation as its core function.

Question 6Introduction to ICS/SCADA Network Defense

A SOC analyst wants to detect unauthorized changes to PLC logic on a control network. Which data source is most directly useful for this goal?

  1. DHCP lease logs from the guest wireless network
  2. Network captures of engineering-protocol write operations to controllers Correct answer.
  3. Web proxy logs from the corporate internet gateway
  4. Email gateway logs for spam filtering

Explanation

Detecting logic changes requires visibility into the engineering protocols used to program controllers, such as captures or protocol-aware monitoring of write operations. Corporate proxy, guest DHCP, and email logs do not show controller programming traffic. This is why span ports or taps on the control network are valuable.

Question 7Introduction to ICS/SCADA Network Defense

Which characteristic most distinguishes ICS security priorities from typical enterprise IT security priorities?

  1. Availability and safety of the physical process usually outrank confidentiality Correct answer.
  2. ICS systems require no patching because they are isolated
  3. Confidentiality always outranks availability in ICS environments
  4. ICS devices always run the latest operating systems

Explanation

In ICS, the priority order is often availability, integrity, then confidentiality, because outages or unsafe control actions can harm people and equipment. Enterprise IT more often prioritizes confidentiality. The claim that ICS needs no patching or always runs current systems is false and dangerous.

Question 8Introduction to ICS/SCADA Network Defense

An organization wants to inventory every device on its control network, including unmanaged switches and legacy RTUs. Which approach best supports this without disrupting the process?

  1. Disabling the control network firewall to allow discovery traffic
  2. Relying only on manual spreadsheets updated yearly
  3. Aggressive full-range port scanning during peak production hours
  4. Passive network monitoring combined with controlled active queries during maintenance windows Correct answer.

Explanation

Passive monitoring observes traffic without touching devices, which is safe for fragile legacy equipment. Active queries, when needed, should be limited and scheduled during maintenance windows to avoid disruption. Aggressive scanning during production or removing firewalls risks outages.

Question 9Introduction to ICS/SCADA Network Defense

What does a demilitarized zone (DMZ) between the ICS network and the corporate network typically contain?

  1. Replicated data and broker services that mediate traffic between the two networks Correct answer.
  2. The primary engineering workstation used to program controllers
  3. Directly connected PLCs exposed to the internet
  4. Domain controllers shared by both networks

Explanation

An ICS DMZ holds services such as replicated historians, patch servers, and jump hosts that broker traffic between IT and OT. This avoids direct connections between the two networks. PLCs, engineering workstations, and shared domain controllers should stay in their proper zones rather than in the DMZ.

Question 10Introduction to ICS/SCADA Network Defense

A defender observes that an HMI is communicating with a PLC using a protocol the HMI has never used before. Which interpretation is most reasonable?

  1. This is anomalous and warrants investigation as possible unauthorized tooling or malware Correct answer.
  2. This proves the PLC firmware was upgraded
  3. This is normal because HMIs always try every protocol
  4. This indicates the firewall is working correctly

Explanation

Baselines of normal protocol use are a core detection method in ICS. A new protocol from an HMI is a deviation worth investigating, since it could indicate malware or unauthorized engineering tools. It does not by itself prove a firmware upgrade or firewall success.

Question 11Introduction to ICS/SCADA Network Defense

Which practice best protects an engineering workstation used to program safety instrumented systems?

  1. Connect it to both the corporate and control networks simultaneously
  2. Share it among all shifts without change tracking
  3. Allow general internet browsing so engineers can download drivers
  4. Dedicate it to that role, restrict its network access, and control removable media Correct answer.

Explanation

Engineering workstations are high-value targets because they can change controller logic. Dedication, restricted connectivity, and controlled removable media reduce the attack surface. Browsing, untracked sharing, and dual-homing undermine those protections.

Question 12Introduction to ICS/SCADA Network Defense

What is the role of a security information and event management (SIEM) system in an ICS defense program?

  1. To directly control PLC output values during a process upset
  2. To physically isolate the control network from all other networks
  3. To aggregate and correlate logs from OT and IT sources for detection and response Correct answer.
  4. To replace the need for network segmentation

Explanation

A SIEM collects and correlates events from many sources, giving analysts a unified view for detection and response. It does not control physical processes, replace segmentation, or provide physical isolation. Those are functions of controllers and network architecture.

Question 13Introduction to ICS/SCADA Network Defense

A plant wants to allow remote vendor support for a PLC without exposing the control network to the internet. Which design is most appropriate?

  1. A permanent VPN terminating directly on the PLC subnet for all vendor staff
  2. An open remote desktop service on the engineering workstation
  3. A jump host in the DMZ with multi-factor authentication, session logging, and time-limited access Correct answer.
  4. Port forwarding on the internet-facing firewall to the PLC

Explanation

Vendor access should be brokered through a controlled jump host in the DMZ with strong authentication, logging, and time limits. This limits exposure and preserves an audit trail. Direct VPNs to the PLC subnet, port forwarding, and open remote desktop greatly increase risk.

Question 14Introduction to ICS/SCADA Network Defense

Which statement best describes the difference between an IDS and an IPS on an ICS network?

  1. An IDS blocks traffic, while an IPS only logs it
  2. Both must be placed inline to function
  3. An IDS alerts on suspicious traffic, while an IPS can actively block it Correct answer.
  4. Both only collect NetFlow records

Explanation

An intrusion detection system monitors and alerts, while an intrusion prevention system can take action to block traffic. In ICS, inline prevention carries risk of disrupting the process, so passive detection is often preferred. NetFlow collection and inline placement are not what distinguish the two.

Question 15Introduction to ICS/SCADA Network Defense

During incident response on a control network, why is simply powering off a suspected compromised PLC often a poor first action?

  1. It can cause unsafe process states or equipment damage, so containment should consider process impact Correct answer.
  2. It disables the SIEM's log collection
  3. It reboots the corporate firewall unexpectedly
  4. It always erases the attacker's forensic evidence permanently

Explanation

Abruptly stopping a controller can leave valves, motors, or other equipment in unsafe positions, so ICS response must weigh process safety before containment. Powering off may also lose volatile evidence, but the dominant concern is physical safety. Firewall and SIEM effects are not the primary reason.

Question 16Introduction to ICS/SCADA Network Defense

What is the main security concern with using default credentials on ICS devices such as HMIs and network switches?

  1. Default credentials improve performance of the device
  2. Attackers who know the vendor defaults can gain access without any cracking effort Correct answer.
  3. Default credentials are required by Modbus for communication
  4. Default credentials automatically encrypt management traffic

Explanation

Vendor default passwords are widely documented and give attackers immediate access when left unchanged. Changing defaults and enforcing unique credentials is a basic hardening step. Defaults do not improve performance, enable Modbus, or add encryption.

Question 17Introduction to ICS/SCADA Network Defense

A defender wants to detect a rogue device plugged into a plant switch. Which combination of controls is most effective?

  1. Disabling all switch logging to reduce noise
  2. Allowing any MAC address on every port
  3. Port security with MAC limits plus alerts on new devices discovered by passive monitoring Correct answer.
  4. Using the same static IP for every device

Explanation

Port security limits which and how many MAC addresses can appear on a switch port, blocking many rogue-device scenarios. Pairing it with passive monitoring alerts on new assets catches devices that still appear. Disabling logging, duplicating IPs, or allowing any MAC removes those safeguards.

Question 18Introduction to ICS/SCADA Network Defense

Which of the following best describes why network baselines are valuable in ICS defense?

  1. They replace the need for firewalls
  2. They define normal traffic patterns so deviations such as new connections or protocols stand out Correct answer.
  3. They guarantee the process will never be disrupted
  4. They permanently block all new devices from connecting

Explanation

A baseline captures what normal communication looks like, including which hosts talk, which protocols they use, and when. Defenders can then flag deviations like new connections or unusual protocols. Baselines inform detection but do not block devices, replace firewalls, or guarantee uptime.

Question 19Introduction to ICS/SCADA Network Defense

What is the purpose of the SANS five critical controls for ICS, such as ICS incident response and defensible architecture?

  1. To eliminate the need for operator training
  2. To mandate a specific vendor's firewall product
  3. To prioritize a small set of high-impact defensive actions for OT environments Correct answer.
  4. To require internet connectivity for all controllers

Explanation

The five critical controls highlight a focused set of practices with high defensive value, such as incident response capability and defensible architecture. They guide prioritization rather than mandating products. They do not remove training needs or require controller internet access.

Question 20Introduction to ICS/SCADA Network Defense

A control network uses a flat Layer 2 design with hundreds of devices on one VLAN. Which risk does this most directly create?

  1. It prevents devices from communicating at all
  2. It guarantees deterministic real-time performance
  3. It automatically encrypts all traffic
  4. Broadcast and lateral movement across the whole segment make containment difficult Correct answer.

Explanation

A flat Layer 2 segment lets any compromised host reach many others and spreads broadcast traffic widely, complicating containment. Segmentation limits blast radius. A flat design does not prevent communication, add encryption, or guarantee real-time behavior.

Question 21Introduction to ICS/SCADA Network Defense

Which measure best reduces the risk of malware spreading via removable media on an ICS network?

  1. Disable antivirus on all control systems
  2. Rely on users to self-report suspicious files
  3. Allow any USB drive to be used on any engineering host
  4. Enforce a controlled media policy with scanning at designated kiosks Correct answer.

Explanation

Removable media are a known infection vector for air-gapped and segmented networks. A controlled policy with scanning at dedicated kiosks limits exposure. Allowing any drive, disabling antivirus, or relying on self-reporting leaves the vector open.

Question 22Introduction to ICS/SCADA Network Defense

What does the term 'defense in depth' mean when applied to an ICS network?

  1. Hiding the network by using obscure IP addresses only
  2. Removing all remote access to simplify the design
  3. Relying on a single strong firewall at the perimeter
  4. Layering multiple independent controls so failure of one does not expose the whole system Correct answer.

Explanation

Defense in depth means combining independent layers such as segmentation, monitoring, hardening, and access control so no single failure is catastrophic. A single perimeter firewall, obscurity, or removing remote access alone does not provide that layered resilience.

Question 23Introduction to ICS/SCADA Network Defense

An analyst sees outbound connections from a historian to an unknown external IP address. Which action sequence is most appropriate?

  1. Immediately power off the historian without investigation
  2. Investigate the flow, confirm whether it is sanctioned, and contain if unauthorized while preserving evidence Correct answer.
  3. Delete the historian's logs to save space
  4. Ignore it because historians never generate alerts

Explanation

Unexpected outbound connections from an OT server can indicate compromise or an unapproved data flow. The analyst should investigate, verify against approved flows, and contain only if unauthorized, preserving evidence. Powering off blindly, ignoring, or deleting logs are all harmful.

Question 24Introduction to ICS/SCADA Network Defense

Which of the following is an example of an appropriate compensating control when a legacy PLC cannot be patched for a known vulnerability?

  1. Expose the PLC to the internet to receive vendor updates
  2. Disable all monitoring to reduce alert noise
  3. Restrict access to the PLC with firewall rules and monitor its traffic closely Correct answer.
  4. Ignore the vulnerability because the device is old

Explanation

When patching is not feasible, compensating controls such as strict access restriction and close monitoring reduce exposure. Ignoring the issue, exposing the device, or disabling monitoring increases risk. Compensating controls are a core concept for legacy OT assets.

Question 25TCP/IP 101

A SCADA front-end needs to reach an RTU across a routed WAN. Which TCP/IP layer is responsible for logical addressing and path selection between the two sites?

  1. Network access layer
  2. Application layer
  3. Internet layer Correct answer.
  4. Transport layer

Explanation

In the TCP/IP model the Internet layer handles logical (IP) addressing and routing decisions between networks, so it determines the path from the control centre to the remote substation. The transport layer only provides end-to-end delivery between processes, and the network access layer is limited to the local link.

Question 26TCP/IP 101

An engineer captures Modbus/TCP traffic and notes the well-known port 502. Which transport protocol and port number does the capture confirm?

  1. UDP port 502
  2. UDP port 161
  3. TCP port 502 Correct answer.
  4. TCP port 102

Explanation

Modbus/TCP is registered to TCP port 502, so a capture showing 502 with a TCP header confirms the expected encapsulation. UDP port 502 is not the registered Modbus/TCP service, and ports 102 and 161 belong to other protocols.

Question 27TCP/IP 101

A field technician must assign an IPv4 address to a new substation gateway that will be the only host on an isolated /30 test segment. Which address is usable for a host on 192.168.10.4/30?

  1. 192.168.10.7
  2. 192.168.10.6
  3. 192.168.10.5 Correct answer.
  4. 192.168.10.4

Explanation

A /30 leaves two host addresses: the first usable address and the last address before the broadcast. For 192.168.10.4/30 the network address is .4, the usable hosts are .5 and .6, and .7 is the broadcast address.

Question 28TCP/IP 101

A SCADA historian sends a 4000-byte report over TCP with a 1460-byte MSS. How does TCP deliver this to the application?

  1. As one 4000-byte datagram delivered atomically
  2. As three datagrams with the last one padded to 1460 bytes
  3. As a byte stream that the application must delimit itself Correct answer.
  4. As two segments because TCP pairs segments before delivery

Explanation

TCP presents an ordered byte stream and does not preserve message boundaries, so a 4000-byte write may arrive as several segments and the receiving application must use length fields or delimiters to reassemble records. This is why many SCADA protocols carry explicit length prefixes.

Question 29TCP/IP 101

Which protocol provides connectionless, best-effort delivery and is therefore often chosen for time-critical SCADA telemetry where retransmission would be stale?

  1. UDP Correct answer.
  2. TCP
  3. ICMP
  4. ARP

Explanation

UDP is connectionless and does not retransmit lost data, which suits periodic telemetry where a late value is worse than a missing one. TCP guarantees delivery at the cost of retransmission delay, while ICMP and ARP are support protocols, not general data transports.

Question 30TCP/IP 101

A control network uses private addresses internally and must reach a vendor support server on the Internet through a single public address. Which mechanism allows many internal hosts to share that address?

  1. Proxy ARP
  2. Spanning Tree Protocol
  3. DHCP relay
  4. Network address translation Correct answer.

Explanation

NAT rewrites source addresses so many private hosts can share one public address, with a translation table tracking each flow. DHCP relay forwards address requests across subnets, proxy ARP answers for another host on the same link, and STP prevents Layer 2 loops.

Question 31TCP/IP 101

An operator reports that a PLC at 10.20.5.40 stops responding after a switch change. The PC at 10.20.5.10/24 can ping other hosts on its own subnet but not the PLC. Which diagnostic step best isolates whether the problem is local delivery or routing?

  1. Inspect the PLC's application-layer response codes
  2. Trace the route to a public DNS server
  3. Check the ARP cache for the PLC's MAC address on the PC Correct answer.
  4. Renew the PC's DHCP lease

Explanation

If the PC and PLC share a /24 but cannot communicate, the fault is likely local delivery, and checking whether the PC resolved the PLC's MAC address separates an ARP/Layer 2 problem from an IP-layer one. Renewing DHCP or tracing to the Internet tests unrelated paths.

Question 32TCP/IP 101

A SCADA server opens a long-lived TCP session to an RTU. Which field in the TCP header lets the receiving stack identify the correct session among many simultaneous connections?

  1. The source and destination port pair Correct answer.
  2. The sequence number alone
  3. The IP time-to-live value
  4. The TCP checksum

Explanation

A TCP connection is identified by the four-tuple of source IP, destination IP, source port and destination port, so the port pair distinguishes concurrent sessions to the same host. Sequence numbers order bytes within one session, TTL limits hops, and the checksum only detects corruption.

Question 33TCP/IP 101

A firewall protecting a substation must permit an RTU to initiate outbound Modbus/TCP sessions to a master while blocking unsolicited inbound connections. Which rule set achieves this?

  1. Permit outbound TCP 502 with stateful return traffic, deny inbound-initiated 502 Correct answer.
  2. Permit inbound UDP 502 and outbound TCP 502
  3. Permit inbound TCP 502 to the RTU, deny all outbound
  4. Deny all TCP 502 in both directions and permit ICMP

Explanation

Allowing the RTU to initiate outbound TCP 502 and permitting only the return traffic for established sessions matches the client role of the RTU. Blocking inbound-initiated 502 prevents the master from opening connections the RTU did not request.

Question 34TCP/IP 101

Which statement correctly describes the role of the default gateway on a SCADA workstation?

  1. It is the broadcast address of the local subnet
  2. It is the address the workstation uses for hosts outside its own subnet Correct answer.
  3. It is the DNS server used to resolve hostnames
  4. It is the MAC address of the local switch

Explanation

When the destination IP is outside the workstation's subnet, the host sends frames to the default gateway's MAC address so the router can forward them. The switch MAC, DNS server and broadcast address serve different functions.

Question 35TCP/IP 101

A SCADA protocol uses UDP for event messages and the network drops one message during congestion. What does the receiving application observe?

  1. A gap in the sequence numbers with no automatic recovery Correct answer.
  2. The message is buffered by the router and delivered later
  3. The connection resets and re-establishes
  4. A retransmitted copy arrives automatically

Explanation

UDP provides no retransmission or ordering guarantees, so a dropped datagram simply never arrives and the application must detect the gap itself, often through sequence numbers. Routers do not buffer indefinitely, and there is no connection to reset.

Question 36TCP/IP 101

An engineer sees the address fe80::1:2:3:4 on an interface of a substation device. What does this address indicate?

  1. A globally routable IPv6 address
  2. An IPv4-mapped address
  3. A link-local IPv6 address valid only on that segment Correct answer.
  4. A multicast group address

Explanation

IPv6 link-local addresses always begin with fe80::/10 and are valid only on the local link, being used for neighbour discovery and on-link communication. Global addresses typically begin with 2000::/3, and multicast uses ff00::/8.

Question 37TCP/IP 101

During a capture, a host sends an ARP request for 10.1.1.20 and receives a reply from a different MAC than the known PLC. What is the most likely security concern in an ICS environment?

  1. ARP spoofing enabling man-in-the-middle interception Correct answer.
  2. A TCP SYN flood against the PLC
  3. A DNS cache poisoning attack
  4. An IP fragmentation overlap attack

Explanation

ARP has no authentication, so a forged reply can bind another MAC address to the PLC's IP and redirect traffic through the attacker. DNS poisoning, SYN floods and fragmentation attacks involve different mechanisms and would not appear as a mismatched ARP reply.

Question 38TCP/IP 101

A SCADA master sends a request to an RTU and the RTU's reply is larger than the path MTU. How does IPv4 handle this if the don't-fragment flag is not set?

  1. The packet is retransmitted with a larger MTU
  2. The packet is fragmented and reassembled at the destination Correct answer.
  3. The packet is fragmented and reassembled at each router
  4. The packet is dropped and an ICMP error is returned

Explanation

With DF clear, IPv4 routers may fragment a packet that exceeds the next-hop MTU, and the destination host reassembles the fragments. Routers do not reassemble, and an ICMP error is returned only when DF is set.

Question 39TCP/IP 101

Which transport-layer feature makes TCP suitable for transferring a large SCADA configuration file to a remote device?

  1. Reliable ordered delivery with flow control Correct answer.
  2. Broadcast delivery to all devices
  3. Built-in encryption of the payload
  4. Connectionless datagram delivery

Explanation

TCP provides reliable, ordered delivery with acknowledgements, retransmission and window-based flow control, which suits a large configuration transfer. UDP is connectionless and unreliable, and TCP itself provides no encryption.

Question 40TCP/IP 101

A control engineer must choose a transport for a protocol that needs low latency and tolerates occasional loss, with application-level sequence numbers already present. Which choice fits best?

  1. ICMP because it carries sequence numbers
  2. TCP because it guarantees delivery
  3. UDP because the application already handles loss detection Correct answer.
  4. SCTP because it is the only option for ICS

Explanation

When the application already tracks sequence numbers and tolerates loss, UDP avoids TCP retransmission delays and head-of-line blocking. TCP adds reliability the application may not want, and ICMP is not a data transport.

Question 41TCP/IP 101

An RTU is configured with address 172.16.20.130/26. What is the directed broadcast address for its subnet?

  1. 172.16.20.127
  2. 172.16.20.191 Correct answer.
  3. 172.16.20.255
  4. 172.16.20.128

Explanation

A /26 uses 64-address blocks, so the block containing .130 runs from .128 to .191, making .191 the broadcast address. The .127 address belongs to the previous block, and .255 would be the broadcast for a /24.

Question 42TCP/IP 101

A technician notices that a SCADA device replies to a ping but rejects a TCP connection to port 502. Which conclusion is best supported?

  1. The device is reachable but nothing is listening on port 502 Correct answer.
  2. The device has no default gateway
  3. The device's IP stack is down
  4. The link layer is failing

Explanation

A successful ping shows the IP stack and path are working, so a refused TCP connection points to the transport layer, typically no listener on that port or a filter rejecting it. Link failure or a down stack would prevent the ping reply as well.

Question 43TCP/IP 101

Which address range is reserved for private use and is therefore common inside an ICS enclave that must not be routed on the Internet?

  1. 169.254.0.0/16
  2. 224.0.0.0/4
  3. 172.16.0.0/12 Correct answer.
  4. 192.0.2.0/24

Explanation

172.16.0.0/12 is one of the RFC 1918 private ranges, along with 10.0.0.0/8 and 192.168.0.0/16. The 192.0.2.0/24 block is documentation, 224.0.0.0/4 is multicast, and 169.254.0.0/16 is link-local.

Question 44TCP/IP 101

A vendor needs to place a new SCADA server on the plant network and asks for a subnet mask that allows at least 500 hosts while wasting as little address space as possible. Which mask fits?

  1. /24
  2. /22
  3. /23 Correct answer.
  4. /25

Explanation

A /23 provides 510 usable host addresses, the smallest power-of-two block that covers 500 hosts. A /24 provides only 254 usable addresses, which is insufficient, and a /22 wastes address space with 1022 usable addresses.

Question 45TCP/IP 101

Which statement best explains why an ICS network segment might use a Layer 2 switch with VLANs rather than a single flat LAN?

  1. VLANs logically separate broadcast domains on shared hardware Correct answer.
  2. VLANs replace the need for IP routing
  3. VLANs encrypt traffic between control zones
  4. VLANs assign IP addresses automatically

Explanation

VLANs divide one physical switch into separate broadcast domains, which limits broadcast traffic and separates control zones without extra cabling. They do not encrypt traffic, eliminate routing between zones, or perform address assignment.

Question 46TCP/IP 101

An attacker on the plant network sends a flood of TCP SYN packets with spoofed source addresses to a PLC's Modbus port. Which resource is most directly exhausted?

  1. The switch's MAC address table
  2. The PLC's half-open connection table Correct answer.
  3. The PLC's DNS resolver cache
  4. The PLC's ARP cache

Explanation

Each SYN creates a half-open connection entry waiting for the final handshake, so a spoofed flood fills the connection table and blocks legitimate sessions. ARP caches, MAC tables and DNS caches are affected by different attack types.

Question 47TCP/IP 101

A SCADA protocol carries a 4-byte length field at the start of each message over TCP. Why is this field necessary for the receiving application?

  1. To compute the TCP checksum
  2. To locate message boundaries in the byte stream Correct answer.
  3. To select the destination port
  4. To set the IP time-to-live

Explanation

Because TCP delivers an unstructured byte stream, the receiver needs an explicit length to know where one application message ends and the next begins. Checksums, ports and TTL are handled by the TCP and IP headers.

Question 48TCP/IP 101

A ping to a remote SCADA host fails while pings to hosts on the local subnet succeed. Which configuration error is most likely?

  1. A duplicate MAC address on the local segment
  2. An incorrect subnet mask on the local host
  3. A missing or incorrect default gateway Correct answer.
  4. An incorrect TCP checksum

Explanation

Successful local pings confirm the mask and link are working, so failure only for remote destinations points to the default gateway or the return path. A wrong mask would typically break local communication, and checksums are recomputed per hop.

Question 49Introduction to Hacking

In an ICS/SCADA context, which term best describes a deliberate attempt to gain unauthorized access to a programmable logic controller (PLC) in order to alter its control logic?

  1. Hacking Correct answer.
  2. Calibration
  3. Commissioning
  4. Redundancy

Explanation

Hacking is the deliberate pursuit of unauthorized access to or control over a system, including industrial controllers. Commissioning, calibration, and redundancy are legitimate engineering activities or resilience properties, not intrusion attempts.

Question 50Introduction to Hacking

Which characteristic most distinguishes an ICS/SCADA environment from a conventional IT enterprise network when a security tester plans an engagement?

  1. Devices prioritize availability and physical process safety over confidentiality Correct answer.
  2. All industrial protocols encrypt traffic by default
  3. Field devices are patched weekly through the internet
  4. Operator workstations run no operating system

Explanation

Industrial control systems are engineered around availability and safe physical operation, so confidentiality often ranks lower and disruptive testing is dangerous. Most industrial protocols historically lack encryption, and field devices are rarely internet-patched. The priority ordering is the defining difference for engagement planning.