Which of the following is a passive reconnaissance technique that can be used to discover OT devices without sending any packets to the target network?

Performing a ping sweep to identify live hosts

Connecting to a PLC and reading its configuration

Monitoring network traffic through a SPAN port or network tap

Using Nmap to scan for open ports

Which of the following tools is commonly used for active enumeration of Modbus devices in an OT environment?

Metasploit's auxiliary scanner for SMB

Burp Suite's active scanner for web applications

Modbus Scanner (e.g., modbus-scanner or Nmap's modbus-discover script)

Wireshark's capture filter for HTTP

A penetration tester has completed an OT assessment and found a critical vulnerability in a PLC that could allow remote shutdown. The client's management wants to understand the business risk, while the engineering team needs specific remediation steps. The tester must produce a report that satisfies both. Which approach is the most effective?

Write a single technical report with all exploit details and let management read it.

Write a report that only lists the CVSS scores and CVE references.

Write a report with an executive summary that translates the vulnerability into potential production loss and safety impact, and a technical appendix with detailed remediation.

Write a report that focuses on the attack narrative and omits remediation to avoid overwhelming the reader.

Which of the following is a common technique for lateral movement from IT to OT networks?

Sending a phishing email directly to a PLC

Using a USB drive to physically connect to an OT device

Using stolen credentials to access a jump server that has connectivity to the OT network

Exploiting a web browser vulnerability on an HMI

Which of the following best describes the primary purpose of a Supervisory Control and Data Acquisition (SCADA) system in an industrial environment?

To provide real-time monitoring and control of geographically dispersed industrial processes

To replace traditional IT networks with a more secure and isolated network architecture

To manage enterprise resource planning (ERP) and financial transactions across an organization

To provide high-speed data transfer between corporate headquarters and branch offices

EC-CouncilCertified Penetration Testing Professional

Domain 7Objective 2

OT and SCADA Penetration Testing CPENT Practice Questions (Page 9)

Part of the Specialized Testing and Reporting domain, which makes up ~23% of our current practice bank.

51questions here

11free pages

10concepts

10 Concepts in This Objective

OT/SCADA Fundamentals
SCADA Protocols and Communication
OT Network Architecture and Segmentation
Attack Surface and Threat Modeling for OT
Passive Reconnaissance and Discovery
Active Scanning and Enumeration
Exploitation of OT Vulnerabilities
Post-Exploitation and Pivoting in OT
Safety and Operational Impact Considerations
Reporting and Remediation for OT

Questions 41–45

41foundation · easy
Which of the following is a passive reconnaissance technique that can be used to discover OT devices without sending any packets to the target network?
Select an answer first
42foundation · easy
Which of the following tools is commonly used for active enumeration of Modbus devices in an OT environment?
Select an answer first
43expert · hard
A penetration tester has completed an OT assessment and found a critical vulnerability in a PLC that could allow remote shutdown. The client's management wants to understand the business risk, while the engineering team needs specific remediation steps. The tester must produce a report that satisfies both. Which approach is the most effective?
Select an answer first
44foundation · easy
Which of the following is a common technique for lateral movement from IT to OT networks?
Select an answer first
45foundation · easy
Which of the following best describes the primary purpose of a Supervisory Control and Data Acquisition (SCADA) system in an industrial environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.