ICS/SCADA study guide
ICS/SCADA · Work through your exam, one topic at a time.
The ICS/SCADA Cybersecurity offering from EC-Council is a hands-on training course built around defending industrial control and supervisory control and data acquisition environments. The vendor frames ICS/SCADA security as a higher priority than traditional IT security because an attack can affect the physical safety of communities, employees, or customers, and it points to malware such as Triton/TRISIS and Stuxnet as evidence that threats capable of disrupting operational technology already exist. The ICS/SCADA study guide has 8 sections and about 2,972 words.
01Introduction to ICS/SCADA Network Defense
The exam tests whether you can separate IT security priorities from OT/ICS priorities and apply defense in depth to control systems. ICS covers DCS, SCADA, PLCs, RTUs, HMIs, historians, and safety instrumented systems (SIS).
360 words, about 2 min02TCP/IP 101
This domain checks whether you can trace a packet from application data to Ethernet frame, read IPv4 addressing and subnet masks, explain TCP versus UDP behavior, and recognize the ports used by ICS protocols. You need enough fluency to troubleshoot why an HMI cannot reach a PLC and to write a firewall rule that permits only the required conversation.
373 words, about 2 min03Introduction to Hacking
The exam tests whether you can describe how an attacker progresses against an ICS environment, map activity to MITRE ATT&CK for ICS, and separate authorized testing from unauthorized intrusion. It is not a malware catalog; it is a model of attacker goals, access paths, and the safety consequences of actions in OT.
362 words, about 2 min04Vulnerability Management
This domain tests risk-based vulnerability management in OT: discovering assets, interpreting CVE and CVSS data, prioritizing by real exposure and process impact, and choosing patch or compensating controls. The exam favors reducing risk without stopping production over applying every vendor patch immediately.
348 words, about 2 min05Standards and Regulations for Cybersecurity
The exam tests whether you know which framework or regulation applies, what it requires at a high level, and where it stops. Expect questions on IEC 62443, NIST SP 800-82, NERC CIP, ISO/IEC 27001 and 27019, and the NIST Cybersecurity Framework.
384 words, about 2 min06Securing the ICS network
This domain tests practical network defense for control systems: segmentation, firewall and DMZ design, secure remote access, endpoint hardening, backups, and monitoring. The exam wants controls that preserve availability while shrinking the attack path from IT and the internet.
368 words, about 2 min07Bridging the Air Gap
The exam tests whether you understand what a true air gap is, how it erodes in practice, and how to transfer data or updates across it without creating a network bridge. Expect questions on removable media, staging, scanning, data diodes, and procedural controls.
388 words, about 2 min08Introduction to Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
This domain tests whether you can distinguish detection from prevention, choose signature or anomaly methods, place sensors correctly, and tune alerts for OT. The key judgment is that blocking traffic in a control network can be riskier than alerting on it.
389 words, about 2 min