Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security consultant is assessing a railway signaling system. The system uses a mix of legacy serial RTUs and modern Ethernet-enabled PLCs. The consultant has been given permission to actively scan the network but must avoid causing any disruption to the signaling operations. Which scanning strategy is most appropriate?

   • APerform a full TCP connect scan on all ports of every device to ensure complete coverage.
   • BUse only passive monitoring and avoid active scanning altogether.
   • CScan only the Ethernet PLCs and ignore the serial RTUs.
   • DUse a slow, low-rate Nmap scan with a limited port list and timeouts to avoid overwhelming devices.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is planning an assessment of a chemical plant's ICS environment. The tester wants to follow a structured methodology that minimizes the chance of missing critical attack paths. Which approach best aligns with the hacking methodology?

   • AOnly use automated tools without manual verification.
   • BFocus solely on the HMI and ignore the PLCs and RTUs.
   • CSkip reconnaissance and go straight to exploiting known ICS vulnerabilities.
   • DPerform passive reconnaissance, then active scanning, then exploitation, and finally document persistence and cleanup.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which technique is commonly used by attackers to maintain persistence in an ICS/SCADA environment?

   • AChanging the IP address of the target device
   • BInstalling a backdoor on an engineering workstation
   • CDisabling the firewall on the OT network
   • DDeleting all system logs to hide activity
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is hired to assess the security of a water treatment facility. The client has strict rules of engagement: no active scanning of the OT network is allowed until a formal change window. The tester needs to start gathering information about the facility's ICS/SCADA environment without touching the network. Which approach best fits the constraint?

   • ARun Nmap with a SYN scan against the OT subnet to map live hosts and open ports.
   • BUse Shodan and public job postings to identify the HMI software and PLC models in use.
   • CDeploy a network tap on the OT switch to passively capture traffic for later analysis.
   • DSend crafted Modbus queries to the PLCs to enumerate their register maps.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An attacker is targeting a regional electrical substation. Before launching any active scans, the attacker wants to build a profile of the substation's equipment and personnel. Which activity is purely passive reconnaissance?

   • APerforming a ping sweep of the substation's public IP range.
   • BConnecting to the substation's VPN endpoint with default credentials.
   • CSending a crafted TCP packet to the substation's firewall to see if it responds.
   • DUsing a search engine to find job postings that mention specific PLC models and software versions.
   Reveal Solution Discussion Select an answer first