ECCouncil ICS-SCADA Cyber Security Practice Test - Questions Answers, Page 2

NIST Special Publication 800-82, 'Guide to Industrial Control Systems (ICS) Security,' provides guidance on securing industrial control systems, including SCADA systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC). It offers practices and recommendations for protecting and securing ICS systems against disruptions, malicious activities, and other threats to their integrity and availability.

Reference:

National Institute of Standards and Technology (NIST), 'Guide to Industrial Control Systems (ICS) Security'.

IPsec (Internet Protocol Security) has two modes: Transport mode and Tunnel mode.

Tunnel mode is used to create a secure connection tunnel between two endpoints (e.g., two gateways, or a client and a gateway) and it encapsulates the entire IP packet.

This mode not only protects the payload but also the header information of the original IP packet, thereby providing a higher level of security compared to Transport mode, which only protects the payload.

Reference

Kent, S. and Seo, K., 'Security Architecture for the Internet Protocol,' RFC 4301, December 2005.

'IPsec Services,' Microsoft TechNet.

The Wayback Machine is an internet service provided by the Internet Archive that allows users to see archived versions of web pages across time, enabling them to browse past versions of a website as it appeared on specific dates.

It captures and stores snapshots of web pages, making it an invaluable tool for accessing the historical state of a website or recovering content that has since been changed or deleted.

Other options like Google Cache may also show snapshots of web pages, but the Wayback Machine is dedicated to this purpose and holds a vast archive of historical web data.

Reference

Internet Archive: https://archive.org

'Using the Wayback Machine,' Internet Archive Help Center.

NIST SP 800-53 is a publication that provides a catalog of security and privacy controls for federal information systems and organizations and promotes the development of secure and resilient federal information and information systems.

According to the NIST SP 800-53 Rev. 5, the framework defines a comprehensive set of controls, which are divided into different families. Among these families, there are specifically nine families categorized under management controls. These include categories such as risk assessment, security planning, program management, and others.

Reference

'NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for Information Systems and Organizations.'

NIST website: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

A masquerade attack involves an attacker pretending to be an authorized user of a system, thus compromising the authentication component of the IT security model. Authentication ensures that the individuals accessing the system are who they claim to be. By masquerading as a legitimate user, an attacker can bypass this security measure and gain unauthorized access to the system.

Reference:

William Stallings, 'Security in Computing'.

A vulnerability that is exploited before the vendor has issued a patch or even before the vulnerability is known to the vendor is referred to as a 'zero-day' vulnerability. The term 'zero-day' refers to the number of days the software vendor has had to address and patch the vulnerability since it was made public---zero, in this case.

Reference:

Symantec Security Response, 'Zero Day Initiative'.

Information management within the context of network security involves several critical functions that ensure data is correctly handled for security operations. These functions include:

Normalization: This process standardizes data formats from various sources to a common format, making it easier to analyze systematically.

Correlation: This function identifies relationships between disparate pieces of data, helping to identify patterns or potential security incidents.

Data enrichment: Adds context to the collected data, enhancing the information with additional details, such as threat intelligence.

All these functions are essential to effective information management in security systems, allowing for more accurate monitoring and faster response to potential threats.

Reference

'Data Enrichment and Correlation in SIEM Systems,' Security Information Management Best Practices.

'Normalization Techniques for Security Data,' Journal of Network Security.

TCP (Transmission Control Protocol) is a connection-oriented protocol used in the majority of internet communications.

Connection-oriented protocols like TCP require a connection to be established between the communicating devices before data is transmitted. This ensures reliable and ordered delivery of data.

TCP manages this by establishing a handshake mechanism (TCP three-way handshake) to set up the connection prior to transmitting data and properly terminating the connection once the communication session has completed.

Reference

'TCP/IP Illustrated, Volume 1: The Protocols' by W. Richard Stevens.

Postel, J., 'Transmission Control Protocol,' RFC 793.

Enumeration is a step in the information-gathering phase of a penetration test or cyber attack where an attacker actively engages with the target to extract detailed information, including IP addressing.

Enumeration: During enumeration, the attacker interacts with network services to gather information such as user accounts, network shares, and IP addresses.

Techniques: Common techniques include using tools like Nmap, Netcat, and Nessus to scan for open ports, services, and to identify the IP addresses in use.

Purpose: The goal is to map the network's structure, find potential entry points, and understand the layout of the target environment.

Because enumeration involves discovering detailed information including IP addresses, it is the correct answer.

Reference

'Enumeration in Ethical Hacking,' GeeksforGeeks, Enumeration.

'Network Enumeration,' Wikipedia, Network Enumeration.