A penetration tester is conducting a passive footprinting engagement against a regional water utility. The tester wants to identify the specific make and model of the HMI software used at the utility's control center without sending any packets to the utility's network. Which approach would be most effective?

Searching job postings and technical forum posts for the utility's control system job titles and required software skills

Using Shodan to search for the utility's public IP addresses and banner information

Running a port scan against the utility's public IP range to detect open HMI ports

Sending a crafted HTTP request to the utility's web server to fingerprint the application

Which of the following is an active information gathering technique used against ICS/SCADA systems?

Reviewing the target's annual report for information about its industrial control systems

Using Google dorks to find exposed SCADA web interfaces

Searching public vulnerability databases for known ICS vulnerabilities

Sending a crafted DNP3 packet to a remote terminal unit (RTU) to observe its response

A junior penetration tester is preparing to assess an ICS environment. The lead tester instructs the junior to begin with footprinting before any active scanning. What is the primary purpose of this initial phase?

To establish a command-and-control channel

To gather as much information as possible about the target without alerting the target

To gain unauthorized access to the target network

To identify vulnerabilities in the target's systems

An OT security team is conducting a footprinting exercise against their own SCADA network. They need to identify all live hosts and the operating systems of the engineering workstations without causing network disruption. Which tool combination is most appropriate?

Metasploit to exploit known vulnerabilities

Wireshark to capture traffic and analyze protocols

Shodan to search for internet-exposed devices

Nmap with OS detection and a ping sweep

An OT penetration tester is conducting active footprinting on a gas pipeline SCADA system. The tester needs to identify which hosts are running the Modbus protocol and determine the network segments. Which tool is best suited for this task?

Nmap with the Modbus NSE script

Wireshark for passive traffic analysis

Metasploit's Modbus auxiliary module

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 2

Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 6)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 26–30

26application · medium
A penetration tester is conducting a passive footprinting engagement against a regional water utility. The tester wants to identify the specific make and model of the HMI software used at the utility's control center without sending any packets to the utility's network. Which approach would be most effective?
Select an answer first
27foundation · easy
Which of the following is an active information gathering technique used against ICS/SCADA systems?
Select an answer first
28application · medium
A junior penetration tester is preparing to assess an ICS environment. The lead tester instructs the junior to begin with footprinting before any active scanning. What is the primary purpose of this initial phase?
Select an answer first
29application · medium
An OT security team is conducting a footprinting exercise against their own SCADA network. They need to identify all live hosts and the operating systems of the engineering workstations without causing network disruption. Which tool combination is most appropriate?
Select an answer first
30application · medium
An OT penetration tester is conducting active footprinting on a gas pipeline SCADA system. The tester needs to identify which hosts are running the Modbus protocol and determine the network segments. Which tool is best suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.