Free ICS/SCADA Cybersecurity Practice Test: Sample Questions

Where Can I Practise with Realistic ICS-SCADA Questions?#

Right here. The section below this primer contains free sample questions pulled directly from the CertCompanion ICS-SCADA bank. The bank is organized around the eight domains of the official outline; the three heaviest, at 16% each, are Introduction to ICS/SCADA Network Defense, Introduction to Hacking, and Securing the ICS/SCADA Network.

Before you start, lock in the exam format so you can simulate conditions accurately.

That works out to 96 seconds per question, which is a useful pace to practise against.

10 free ICS-SCADA practice questions#

These are real questions from our 627-question ICS-SCADA bank - the same pool the full practice exam draws from, not simplified samples. Answer before you expand the explanation.

Question 1#

A nuclear facility implements IEC 62443 security architecture and completes a security assessment. The asset owner defines Security Level Target (SL-T) requirements, and component vendors provide Security Level Capability (SL-C) ratings. After system integration, testing reveals the deployed solution achieves Security Level 2 for most foundational requirements but only Security Level 1 for FR5 (Restricted Data Flow). What does this scenario indicate about the system's overall security posture? (Select one!)

• A. The Security Level Target (SL-T) must be reduced to SL-1 to align with demonstrated capabilities
• B. The system is non-compliant because SL-C ratings from vendors do not match the deployed SL-A results
• C. The Security Level Achieved (SL-A) is SL-1 because overall security is limited by the lowest foundational requirement rating
• D. The Security Level Achieved (SL-A) is SL-2 because most foundational requirements meet that level

Show answer and explanation

Correct answer: C. The Security Level Achieved (SL-A) is SL-1 because overall security is limited by the lowest foundational requirement rating

In IEC 62443, Security Levels are expressed as vectors across all seven Foundational Requirements: SL = (FR1, FR2, FR3, FR4, FR5, FR6, FR7). The overall Security Level Achieved (SL-A) is determined by the lowest-rated foundational requirement because security is only as strong as the weakest control. In this scenario, even though most foundational requirements achieve SL-2, FR5 (Restricted Data Flow) only achieves SL-1, making the overall SL-A equal to SL-1. This reflects the reality that inadequate network segmentation controls (FR5) can undermine all other security measures. The overall security is not determined by averaging or majority of requirements. The gap between vendor SL-C (component capability) and deployed SL-A (achieved security) is expected because proper integration and configuration are required to realize component capabilities. The SL-T (target) should not be automatically reduced, instead, remediation should focus on improving FR5 controls through better network segmentation.

Question 2#

A refinery security team discovers the PIPEDREAM/Incontroller malware framework on their network before it executes. The incident response team must identify which systems are potential targets based on PIPEDREAM's known capabilities. Which three device types are specifically targeted by PIPEDREAM components? (Select three!)

• A. Schneider Electric MODICON PLCs
• B. Siemens S7-1200/1500 PLCs
• C. OMRON Sysmac PLCs
• D. Allen-Bradley ControlLogix PLCs
• E. CODESYS-based controllers
• F. Triconex safety controllers

Show answer and explanation

Correct answer: A. Schneider Electric MODICON PLCs and C. OMRON Sysmac PLCs and E. CODESYS-based controllers

PIPEDREAM/Incontroller specifically targets Schneider Electric MODICON PLCs through the EVILSCHOLAR component, OMRON Sysmac PLCs via the BADOMEN component that exploits the OMRON FINS protocol on port 9600, and CODESYS-based devices through EVILSCHOLAR. The framework also includes MOUSEHOLE for OPC-UA servers and represents the most sophisticated ICS attack toolkit discovered before deployment. Siemens S7 PLCs were targets of Stuxnet but are not specifically targeted by PIPEDREAM. Allen-Bradley ControlLogix controllers use EtherNet/IP which PIPEDREAM does not specifically target. Triconex safety controllers were targeted by TRITON/TRISIS malware, not PIPEDREAM.

Question 3#

A manufacturing facility implements IEC 62443 security architecture and must determine the appropriate security level for a chemical mixing process control system. The risk assessment identifies threats from competitors with moderate industrial expertise who might attempt to steal process recipes or disrupt production. The attackers would use readily available penetration testing tools and have budgets under $50,000. Which Security Level Target (SL-T) should the facility assign to this system? (Select one!)

• A. Security Level 4 (SL-4) - Protection against intentional attack employing advanced techniques and substantial resources
• B. Security Level 1 (SL-1) - Protection against casual or accidental misuse
• C. Security Level 3 (SL-3) - Protection against intentional attack backed by specialized skills and moderate resources
• D. Security Level 2 (SL-2) - Protection against intentional attack using simple tools and limited know-how

Show answer and explanation

Correct answer: C. Security Level 3 (SL-3) - Protection against intentional attack backed by specialized skills and moderate resources

Security Level 3 is correct because the threat profile describes attackers with specialized industrial automation skills, moderate financial resources under $50,000, and specific motivation targeting process intellectual property. SL-3 specifically addresses intentional attacks backed by specialized skills and moderate resources. Security Level 1 only protects against accidental misuse without malicious intent. Security Level 2 addresses simple attacks using basic tools without specialized knowledge. Security Level 4 would be excessive for this threat profile as it addresses nation-state level threats with extensive resources and advanced persistent threat capabilities.

Question 4#

A nuclear facility implements IEC 61508 compliant Safety Instrumented Systems with SIL 3 rating for reactor protection. The safety PLC uses Triple Modular Redundancy (TMR) architecture. How many redundant modules must agree for the system to take action? (Select one!)

• A. All three modules must agree (3-out-of-3 voting)
• B. Majority of available modules after fault detection
• C. Any single module can trigger action (1-out-of-3 voting)
• D. At least two modules must agree (2-out-of-3 voting)

Show answer and explanation

Correct answer: D. At least two modules must agree (2-out-of-3 voting)

Triple Modular Redundancy for safety systems uses 2-out-of-3 voting logic where at least two of the three redundant modules must agree before action is taken. This provides fault tolerance allowing one module to fail or disagree while maintaining safe operation based on the majority vote. Requiring all three modules to agree would create vulnerability to single module failures defeating the redundancy purpose. Single module triggering would allow spurious trips from a single fault. Dynamic majority calculation is not how TMR voting works in IEC 61508 safety systems.

Question 5#

A manufacturing facility implements IEC 62443 security standards with multiple production zones. The asset owner completes risk assessment and assigns Security Level Target (SL-T) values to each zone. Zone A requires SL-T of 3 while Zone B requires SL-T of 2. A conduit connects the two zones using a firewall with SL-C of 2. What security level has the automation solution achieved for the conduit? (Select one!)

• A. SL-A of 2 because the conduit capability limits the achieved security level
• B. SL-A of 1 because mismatched zone security levels reduce overall security
• C. SL-A of 3 because the conduit must match the highest zone security level
• D. SL-A of 2.5 representing the average of the connected zone requirements

Show answer and explanation

Correct answer: A. SL-A of 2 because the conduit capability limits the achieved security level

SL-A of 2 is correct because the achieved security level cannot exceed the capability security level of the implemented components. The firewall has SL-C of 2, meaning it can only provide Security Level 2 protections regardless of higher target requirements. IEC 62443 defines SL-C as native technical security countermeasures available within a component, SL-T as desired security level, and SL-A as actual measured security level after implementation. The conduit cannot achieve SL-A higher than its component capabilities. Security levels are not averaged or automatically matched to connected zones. The mismatched levels indicate the conduit does not meet Zone A requirements and compensating controls are needed.

Question 6#

A cybersecurity consultant performs authorized ICS security testing using Metasploit auxiliary modules in an isolated lab environment. The consultant needs to enumerate Modbus unit IDs to identify all Modbus slaves on the network segment before proceeding with read operations. Which Metasploit module should be used for Modbus unit ID enumeration? (Select one!)

• A. auxiliary/scanner/scada/modbus_findunitid for unit ID enumeration
• B. exploit/scada/modbus_write for writing test values to coils
• C. auxiliary/scanner/scada/modbusclient for reading holding registers
• D. auxiliary/scanner/scada/modbusdetect for service detection

Show answer and explanation

Correct answer: A. auxiliary/scanner/scada/modbus_findunitid for unit ID enumeration

The auxiliary/scanner/scada/modbus_findunitid module is specifically designed to enumerate Modbus unit IDs by systematically querying different unit ID values to identify responsive Modbus slave devices. This enumeration helps map the Modbus network topology before performing read or write operations. The modbusdetect module identifies whether Modbus TCP service is running on port 502 but does not enumerate unit IDs. The modbusclient module performs read and write operations on known unit IDs but is not designed for enumeration. There is no exploit/scada/modbus_write module in standard Metasploit distributions, and using write operations for enumeration would be inappropriate and potentially disruptive to ICS operations. Unit ID enumeration should be performed first to identify targets before attempting any read operations.

Question 7#

A control systems engineer develops PLC code using Structured Text (ST) for implementing complex mathematical calculations and PID loop tuning algorithms in a pharmaceutical production line. The code requires conditional statements, loops, and function calls. Which IEC 61131-3 programming language provides Pascal-like high-level syntax suitable for this application? (Select one!)

• A. Function Block Diagram (FBD) for graphical interconnection of control blocks
• B. Instruction List (IL) providing assembly-like low-level programming
• C. Structured Text (ST) offering Pascal-like syntax for complex algorithms
• D. Ladder Diagram (LD) optimized for relay logic and discrete control

Show answer and explanation

Correct answer: C. Structured Text (ST) offering Pascal-like syntax for complex algorithms

Structured Text provides Pascal-like syntax ideal for complex algorithms including mathematical calculations, conditional logic, loops, and function calls. ST is one of the five IEC 61131-3 languages and is called SCL (Structured Control Language) in Siemens systems. It excels at applications requiring complex data manipulation that would be cumbersome in graphical languages. Ladder Diagram is designed for discrete logic and interlocking but is inefficient for mathematical algorithms. Function Block Diagram uses graphical blocks suitable for continuous control but lacks the expressiveness needed for complex procedural code. Instruction List provides low-level control similar to assembly language but has poor readability for complex algorithms requiring validation in regulated pharmaceutical environments.

Question 8#

A utility company must comply with NERC CIP standards for Bulk Electric System protection. They are implementing Electronic Security Perimeters around High Impact BES Cyber Systems. Which two components are mandatory for compliance? (Select two!)

• A. Defined Electronic Security Perimeter (ESP) boundary with identified access points
• B. Intrusion detection systems at all ESP access points
• C. Electronic Access Points (EAPs) with inbound and outbound access controls
• D. Multi-factor authentication for all remote access
• E. Network segmentation using VLANs only

Show answer and explanation

Correct answer: A. Defined Electronic Security Perimeter (ESP) boundary with identified access points and C. Electronic Access Points (EAPs) with inbound and outbound access controls

Defining an Electronic Security Perimeter boundary around BES Cyber Systems and implementing Electronic Access Points with both inbound and outbound access controls at all entry points are fundamental requirements for protecting High Impact BES Cyber Systems. Intrusion detection is addressed separately in NERC CIP standards and is not specifically an ESP boundary requirement. Multi-factor authentication is required for remote access but the question asks for components of the ESP itself. VLAN-only segmentation is insufficient as proper ESP implementation requires logical or physical isolation, and VLANs alone without additional controls don't meet the standard.

Question 9#

A manufacturing facility's ICS security team detects anomalous traffic on the control network. The analyst observes Modbus function code 8 (Diagnostics) with subfunction 0x0001 being sent repeatedly to multiple slave devices. What is the most likely explanation for this traffic pattern? (Select one!)

• A. Normal polling traffic from the SCADA master to verify slave device health
• B. A reconnaissance scan using Modbus diagnostics to enumerate responsive devices
• C. A firmware update being pushed to field devices via Modbus diagnostic functions
• D. A safety interlock test triggered by the distributed control system

Show answer and explanation

Correct answer: B. A reconnaissance scan using Modbus diagnostics to enumerate responsive devices

Modbus function code 8 with subfunction 0x0001 (Restart Communications Option) sent repeatedly to multiple devices is characteristic of reconnaissance activity rather than normal operations. Legitimate SCADA polling uses read functions (FC1, FC2, FC3, FC4) for data acquisition, not diagnostic functions. Sending diagnostics to multiple sequential addresses maps the Modbus network and identifies responsive slave devices, which is a known enumeration technique. Firmware updates do not use Modbus diagnostic subcodes. Safety interlock tests are coordinated events on specific devices, not broadcast patterns across multiple slave addresses.

Question 10#

An ICS security architect must implement Defense in Depth for a water treatment facility's SCADA network following NIST SP 800-82 guidance. The facility has a corporate IT network, a SCADA historian, real-time control systems, and field devices. Which network architecture provides the most appropriate segmentation? (Select one!)

• A. Flat network with VLANs separating corporate and control systems
• B. DMZ architecture with the historian in a demilitarized zone between corporate IT and control networks
• C. Direct connection between corporate IT and control networks protected by a single firewall
• D. Air gap between all network segments with manual data transfer via removable media

Show answer and explanation

Correct answer: B. DMZ architecture with the historian in a demilitarized zone between corporate IT and control networks

NIST SP 800-82 recommends placing data historians and other systems requiring communication with both corporate IT and control networks in a DMZ between the two network segments. This architecture allows the historian to collect data from control systems and share it with business systems without creating a direct path between corporate IT and operational technology networks. A flat network with VLANs provides insufficient isolation because VLAN hopping attacks can breach segment boundaries. A single firewall between corporate and control networks creates a single point of failure. Complete air gaps prevent necessary data exchange and are impractical for modern SCADA systems requiring remote monitoring.

How Should I Use This Sample Test?#

Time yourself at the exam's pace of 96 seconds per question, so ten questions get about sixteen minutes. Don't look anything up mid-attempt: the goal is a diagnostic reading, not a study session.

When you finish, score yourself honestly. Count an answer as correct only if it was your first instinct; an answer you changed to a wrong one counts as wrong. Compare the result with the 70% passing mark, and remember that ten questions are a small sample. Treat the result as a rough signal, then use the full bank for a steadier reading.

What the Ten Sample Questions Cover#

Every question above is a scenario, not a definition. They span the security standards and safety standards that frame industrial control systems (IEC 62443 security levels, IEC 61508 safety integrity levels, NERC CIP electronic security perimeters, NIST SP 800-82 defense in depth), incident response to ICS malware, authorized testing with Metasploit modules in a lab, PLC programming with Structured Text, and recognizing anomalous Modbus traffic.

Notice the OT framing in the answer explanations. In an industrial environment, safety and availability often outrank confidentiality, so the IT habit of patching immediately or locking things down can be the wrong answer. Reading the explanations carefully is where these questions teach the most.

How to Go Beyond Multiple Choice#

Questions about protocols read differently once you have seen the traffic. Set up a basic lab with a Modbus simulator such as ModRSsim2, run Metasploit's Modbus scanner against it in an isolated environment, and look at what the traffic produces. For IPsec, configure a tunnel between a pair of virtual machines and step through transport mode and tunnel mode by hand. A couple of hours of this makes scenario questions about segmentation and protocol attacks far easier to reason about.

What to Do After You Finish#

Look at which questions you missed and group them by topic: standards, malware and incident response, protocol attacks, or network defense design. Drill the topic where you dropped the most points in the full CertCompanion bank, and re-read the explanation for every miss, not only the ones you got wrong by a wide margin.

For the standards questions in particular, IEC 62443 and NIST SP 800-82 reward precise terminology, so keep their glossaries open while you review. To see what else is available for EC-Council exams, browse the EC-Council exam catalog on CertCompanion.

Frequently Asked Questions#

How many questions are on the ICS-SCADA exam and how long do I have? 75 multiple-choice questions in 120 minutes, which is 96 seconds per question on average.

What score do I need to pass the ICS-SCADA exam? 70%, which means 53 correct answers out of 75.

Are these the real exam questions? No. They are practice questions from our own bank, written around the topics of the official outline, each with an explanation. They help you find gaps; they do not reproduce the live exam.

What do the sample questions cover? Industrial security standards (IEC 62443, IEC 61508, NERC CIP, NIST SP 800-82), ICS malware response, authorized testing with Metasploit modules, PLC programming in Structured Text and Modbus traffic analysis. The full bank covers all eight domains of the outline.

How many free questions can I try? The ten above are free to read. You can start with 30 free questions in the full practice exam, with no purchase required.

The ICS-SCADA exam asks you to hold IT security knowledge and OT constraints in your head at once. Use the ten questions above as an honest baseline, read every explanation, and then work through the full bank domain by domain.

Start with 30 free practice questions, no account required, at CertCompanion's ICS-SCADA exam page.

Checked against official EC-Council ICS-SCADA exam documentation. Last verified 2026-10-27.