Most Recent Eccouncil ICS-SCADA Exam Questions & Answers

A Network Intrusion Prevention System (NIPS) is capable of monitoring and validating encrypted data if it is integrated with technologies that allow it to decrypt the traffic.

Typically, network IPS can be set up with SSL/TLS decryption capabilities to inspect encrypted data as it traverses the network. This allows the IPS to analyze the content of encrypted packets and apply security policies accordingly.

Monitoring encrypted traffic is critical in detecting hidden malware, unauthorized data exfiltration, and other security threats concealed within SSL/TLS encrypted sessions.

Reference

'Network Security Technologies and Solutions,' by Yusuf Bhaiji, Cisco Press.

'Decrypting SSL/TLS Traffic with IPS,' by Palo Alto Networks.

The term 'Dropper' in cybersecurity refers to a small piece of software used in malware deployment that is designed to install or 'drop' malware (like viruses, ransomware, spyware) onto the target system.

The Dropper itself is not typically malicious in behavior; however, it is used as a vehicle to install malware that will perform malicious activities without detection.

During the infection process, the Dropper is usually the first executable that runs on a system. It then unpacks or downloads additional malicious components onto the system.

Reference

Common Malware Enumeration (CME): http://cme.mitre.org

Microsoft Malware Protection Center: https://www.microsoft.com/en-us/wdsi

A network switch typically operates at Layer 2 of the OSI model, which is the Data Link layer. This layer is responsible for node-to-node data transfer---a function that involves handling data frames between physical devices on the same network or link. The switch uses MAC addresses to forward data to the appropriate destination within the network. Reference:

Andrew S. Tanenbaum, 'Computer Networks'.

The protocol number 6 represents TCP (Transmission Control Protocol) in the Internet Protocol suite. TCP is a core protocol of the Internet Protocol suite and operates at the transport layer, providing reliable, ordered, and error-checked delivery of a stream of bytes between applications running on hosts communicating via an IP network. Reference:

RFC 793, 'Transmission Control Protocol,' which specifies the detailed operation of TCP.

IPsec offers two modes of operation: Transport mode and Tunnel mode.

Transport mode in IPsec provides security for the payload (the message part) of each packet along the communication path between two endpoints.

In this mode, the IP header of the original packet is not encrypted; it secures only the payload, not protecting the headers. This means while the data is protected, information about the sender and receiver as contained in the IP header is not obscured.

Reference

'Security Architecture for IP,' RFC 4301.

IPsec documentation, Internet Engineering Task Force (IETF).