A penetration tester is assessing a railway signaling system. The client has provided a network diagram but wants the tester to verify the actual devices on the network. The tester has been given a maintenance window of 30 minutes. Which approach is most efficient for identifying live hosts and their roles?

Use a fast ping sweep to identify live hosts, then query each host with SNMP to determine its role.

Manually connect to each IP address using a web browser to check for HMIs.

Use ARP spoofing to intercept traffic and infer device roles from the data.

Perform a full port scan on every IP address in the /16 range.

During an authorized penetration test of a food processing plant, you need to identify all devices that speak the DNP3 protocol. You have access to the OT network but want to minimize disruption. Which scanning technique is most appropriate?

Run a ping sweep to identify live hosts and then assume all are DNP3 devices.

Send DNP3 application-layer requests to each IP address on the OT subnet and analyze responses.

Perform a full TCP connect scan on all ports for every IP address.

Use a UDP scan on port 20000 for all IPs.

A security engineer is tasked with identifying all unpatched vulnerabilities in a legacy SCADA system. The system is running a mix of Windows 2003 servers and proprietary RTUs. The engineer has limited time and cannot risk crashing any device. Which approach is most appropriate?

Use a port scanner to identify open ports and then assume all open ports are vulnerable.

Manually check each device for missing patches by logging in with default credentials.

Run an active vulnerability scanner with default settings against all devices.

Perform a passive vulnerability assessment by analyzing captured traffic and comparing device versions against known vulnerability databases.

A security team is conducting a tabletop exercise for a cyber incident at a hydroelectric dam. They are simulating an attacker who starts by searching for publicly available information about the dam's control systems, then moves to identifying network vulnerabilities. Which two phases of the hacking process are being simulated?

Exploitation and maintaining access

Reconnaissance and covering tracks

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 1

Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 5)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 21–25

21application · medium
A penetration tester is assessing a railway signaling system. The client has provided a network diagram but wants the tester to verify the actual devices on the network. The tester has been given a maintenance window of 30 minutes. Which approach is most efficient for identifying live hosts and their roles?
Select an answer first
22application · medium
During an authorized penetration test of a food processing plant, you need to identify all devices that speak the DNP3 protocol. You have access to the OT network but want to minimize disruption. Which scanning technique is most appropriate?
Select an answer first
23expert · medium
A security engineer is tasked with identifying all unpatched vulnerabilities in a legacy SCADA system. The system is running a mix of Windows 2003 servers and proprietary RTUs. The engineer has limited time and cannot risk crashing any device. Which approach is most appropriate?
Select an answer first
24application · medium
A security team is conducting a tabletop exercise for a cyber incident at a hydroelectric dam. They are simulating an attacker who starts by searching for publicly available information about the dam's control systems, then moves to identifying network vulnerabilities. Which two phases of the hacking process are being simulated?
Select an answer first
25application · medium
A forensic investigator is analyzing a compromised SCADA system. The attacker gained access through a vulnerable web portal and then created a new user account with administrative privileges. Which phase of the hacking process does the creation of a new account represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.

Hacking Methodology and the Hacking Process ICSSCADA Practice Questions (Page 5)

Questions 21–25

During an authorized penetration test of a food processing plant, you need to identify all devices that speak the DNP3 protocol. You have access to the OT network but want to minimize disruption. Which scanning technique is most appropriate?

A security engineer is tasked with identifying all unpatched vulnerabilities in a legacy SCADA system. The system is running a mix of Windows 2003 servers and proprietary RTUs. The engineer has limited time and cannot risk crashing any device. Which approach is most appropriate?

A forensic investigator is analyzing a compromised SCADA system. The attacker gained access through a vulnerable web portal and then created a new user account with administrative privileges. Which phase of the hacking process does the creation of a new account represent?

Keep studying — Introduction to Hacking ICS/SCADA