Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An ICS security manager wants to reduce the risk of an attacker using passive footprinting to learn about the organization's control system architecture. Which countermeasure is most directly effective?

   • AImplementing multi-factor authentication for remote access
   • BDeploying a next-generation firewall with intrusion prevention
   • CDeveloping and enforcing a social media and public documentation policy for employees
   • DConducting regular vulnerability scans of the OT network
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An assessor is mapping a large ICS network that spans multiple sites connected via a WAN. The assessor needs to identify all layer-2 segments and the interconnections between them, but the network uses a mix of managed and unmanaged switches. The assessor has administrative access to the managed switches but not to the unmanaged ones. Which approach is most effective?

   • ADeploying a network tap on each WAN link to capture traffic
   • BQuerying the managed switches' ARP tables and MAC address tables to infer segment membership and interconnections
   • CPerforming a ping sweep of all possible IP addresses on the WAN
   • DUsing traceroute from each site to map layer-3 paths
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security consultant is tasked with mapping the network topology of a large oil refinery's OT environment. The refinery has multiple geographically dispersed sites connected via a private WAN. The consultant has been given read-only access to the network management system (NMS) and a SPAN port on the core switch at the main site. The consultant must produce a topology map that includes remote sites. Which approach is most effective?

   • AUse a network discovery tool like SolarWinds to scan all subnets and automatically generate a topology map
   • BUse traceroute from the main site to each remote site's devices to map the WAN paths
   • CUse Shodan to search for the refinery's public IP ranges and infer the topology from exposed devices
   • DUse the NMS to export a list of all devices and their connections, then supplement with SPAN port traffic analysis to validate the map
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which practice helps mitigate the risk of footprinting by reducing publicly available information about an ICS/SCADA environment?

   • AIncreasing the number of open ports on the firewall to confuse attackers
   • BMinimizing the publication of technical details in job postings and public documents
   • CEncouraging employees to share their job responsibilities on social media
   • DPublishing detailed network diagrams on the company website for transparency
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An assessor needs to identify the operating system and patch level of a legacy Windows-based HMI that is critical to production. The HMI is on a flat OT network with no firewall between the assessor's workstation and the HMI. The assessor must avoid crashing the HMI or causing a blue screen. Which technique is most appropriate?

   • AUsing Metasploit's SMB version scanner
   • BSending a crafted SMB packet to trigger a vulnerability check
   • CUsing Nmap with OS detection and service version detection using a slow timing template
   • DPerforming a full TCP connect scan on all 65535 ports
   Reveal Solution Discussion Select an answer first