A consultant is footprinting a municipal water treatment facility and needs to map the network topology without sending any packets into the OT environment. The consultant has access to the facility's IT network and a SPAN port on the core switch that mirrors OT traffic. Which technique is most appropriate?

Query the facility's DNS server for host records in the OT domain

Capture traffic on the SPAN port and analyze the packet headers to build a map of IP addresses, subnets, and communication flows

Use ARP scanning on the OT subnets to discover active hosts

Run traceroute from the IT network to each OT device IP to infer the routing path

A penetration tester is performing organizational footprinting on a nuclear research facility. The tester has identified a key engineer through LinkedIn and found a conference presentation that includes a network diagram of the facility's control system. The tester also notices that the engineer's personal blog mentions a specific vendor's DCS and includes a photo of a control room with visible screen labels. The tester wants to gather more information without alerting the target. Which approach is most effective?

Send a phishing email to the engineer to trick them into revealing more details about the DCS configuration

Use Shodan to search for the facility's public IP range and identify exposed devices

Search for more of the engineer's presentations and publications, and use the Wayback Machine to find older versions of the facility's website

Use the network diagram from the presentation to identify IP addresses and then scan them with Nmap

A security assessor is performing a pre-engagement footprinting exercise against a regional water utility. The assessor has no direct network access yet and must build a profile of the organization's OT environment using only publicly available information. Which combination of actions best achieves this objective?

Running Nmap against the utility's public IP range to identify open ports and then using banner grabbing to determine device types

Sending spear-phishing emails to OT engineers to trick them into revealing the SCADA software version in use

Searching job postings for OT-specific roles, reviewing the utility's annual reports for capital project mentions, and querying Shodan for internet-exposed HMIs

Using a vulnerability scanner to identify known CVEs in the utility's externally accessible web portal

An OT security team is conducting an active footprinting exercise on a mixed IT/OT environment. The team needs to identify which hosts are part of the OT network and which are IT, but the network uses network address translation (NAT) at the boundary. The team has access to the OT network but not the IT network. Which approach is most effective?

Performing a ping sweep of the IT network from the OT side

Querying the DNS server for all hostnames

Scanning the OT network and correlating the results with the NAT translation table on the boundary firewall

Using traceroute from an OT host to an external IP to map the network path

A security analyst is reviewing the organization's exposure to passive footprinting. The analyst wants to reduce the amount of information an external attacker could gather passively about the ICS environment. Which measure is most effective?

Implementing a policy to remove technical details from job postings and public vendor case studies

Configuring the firewall to block all inbound ICMP traffic

Deploying an IDS to monitor for scanning activity

Changing default passwords on all network devices

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 2

Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 3)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 11–15

11application · medium
A consultant is footprinting a municipal water treatment facility and needs to map the network topology without sending any packets into the OT environment. The consultant has access to the facility's IT network and a SPAN port on the core switch that mirrors OT traffic. Which technique is most appropriate?
Select an answer first
12expert · hard
A penetration tester is performing organizational footprinting on a nuclear research facility. The tester has identified a key engineer through LinkedIn and found a conference presentation that includes a network diagram of the facility's control system. The tester also notices that the engineer's personal blog mentions a specific vendor's DCS and includes a photo of a control room with visible screen labels. The tester wants to gather more information without alerting the target. Which approach is most effective?
Select an answer first
13application · medium
A security assessor is performing a pre-engagement footprinting exercise against a regional water utility. The assessor has no direct network access yet and must build a profile of the organization's OT environment using only publicly available information. Which combination of actions best achieves this objective?
Select an answer first
14expert · hard
An OT security team is conducting an active footprinting exercise on a mixed IT/OT environment. The team needs to identify which hosts are part of the OT network and which are IT, but the network uses network address translation (NAT) at the boundary. The team has access to the OT network but not the IT network. Which approach is most effective?
Select an answer first
15application · medium
A security analyst is reviewing the organization's exposure to passive footprinting. The analyst wants to reduce the amount of information an external attacker could gather passively about the ICS environment. Which measure is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.

Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 3)

Questions 11–15

A security analyst is reviewing the organization's exposure to passive footprinting. The analyst wants to reduce the amount of information an external attacker could gather passively about the ICS environment. Which measure is most effective?

Keep studying — Introduction to Hacking ICS/SCADA