Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which action is classified as active information gathering in the context of ICS/SCADA footprinting?

   • AMonitoring public social media for mentions of the target's control system issues
   • BSearching for the target's ICS equipment manuals on the vendor's website
   • CQuerying the target's DNS records using a public DNS resolver
   • DPerforming a banner grab on a PLC's Modbus port
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is footprinting a food processing plant's OT network. The tester needs to identify the firmware version of a specific RTU. The RTU is on a segment that is isolated from the IT network, but the tester has physical access to a maintenance laptop connected to the same switch. Which active technique is most appropriate?

   • AUse a generic SNMP walk to enumerate the RTU's MIB for firmware details
   • BUse the RTU's proprietary vendor tool to query the device's status and firmware version
   • CRun a full Nmap port scan on the RTU's IP address to identify open ports and services
   • DCapture traffic on the switch using a mirror port and analyze the RTU's communication patterns
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An ICS security consultant is footprinting a natural gas compressor station. The station uses a mix of legacy serial RTUs and modern Ethernet PLCs. The consultant needs to identify the make and model of all devices, but the serial RTUs are not directly connected to the IP network. Which approach is most effective?

   • AUse Nmap to scan the Ethernet PLCs and then use a serial-to-Ethernet converter's web interface to query the serial RTUs
   • BUse a vulnerability scanner with a serial protocol plugin to directly scan the serial RTUs
   • CUse Shodan to search for the compressor station's public IP range and identify all devices
   • DUse only passive network monitoring to identify devices from traffic, including serial RTUs that may be communicating through a gateway
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A threat intelligence analyst is investigating a potential attack against a regional transit authority's SCADA system. The analyst wants to determine if the attackers used passive footprinting to identify the specific PLC models used in the signaling system. Which evidence would most strongly indicate passive footprinting?

   • AThe attackers' IP addresses were traced to a foreign country
   • BThe attackers left malware on the engineering workstation
   • CThe attackers used a known exploit that targets a specific PLC firmware version
   • DThe attackers referenced a specific PLC model that appears in a publicly available engineering conference presentation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An authorized assessor is mapping the network topology of a water treatment facility's OT network. The assessor has discovered a subnet with several PLCs and needs to determine the network paths between the engineering workstation and the PLCs. Which technique would be most effective?

   • AUsing a protocol analyzer to capture broadcast traffic
   • BUsing traceroute from the engineering workstation to each PLC IP address
   • CQuerying the DNS server for PLC hostnames
   • DPerforming a passive ARP cache inspection on the workstation
   Reveal Solution Discussion Select an answer first