A security consultant is footprinting a mining company's OT network. The consultant needs to identify all devices that support the Modbus TCP protocol. Which tool is best suited for this task?

Nmap with the modbus-discover script

Metasploit's modbusclient auxiliary module

Which technique is commonly used to map the network topology of an ICS/SCADA environment?

Traceroute to identify the path between the attacker and the target network

Searching the target's website for employee email addresses

Using social engineering to obtain the target's floor plan

Reviewing the target's annual report for financial data

During an active footprinting engagement, an assessor needs to identify the firmware version of a specific RTU in a remote pumping station. The RTU is on a serial-to-Ethernet gateway. Which technique is most appropriate?

Connecting to the gateway's web interface and reading the device status page

Sending a broadcast ping to the entire subnet

Performing a DNS lookup on the RTU's hostname

Using a port scanner to enumerate open TCP ports

A penetration tester is performing passive reconnaissance on a power utility. The tester wants to identify the physical locations of substations and the names of key engineering personnel. Which OSINT source would be most useful?

Public regulatory filings and industry conference attendee lists

Social media posts from the utility's customers

The utility's DNS zone transfer

A port scan of the utility's corporate network

A security architect is designing countermeasures to reduce the risk of footprinting against a nuclear research facility's ICS. The facility is subject to strict regulatory requirements that limit what can be published. The architect must balance operational transparency with security. Which countermeasure is most effective?

Using encryption for all ICS communications

Implementing strict access controls on the ICS network

Establishing a formal review process for all public releases to remove technical details about control systems

Deploying a honeypot that mimics the ICS environment to detect footprinting attempts

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 2

Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 8)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 36–40

36application · medium
A security consultant is footprinting a mining company's OT network. The consultant needs to identify all devices that support the Modbus TCP protocol. Which tool is best suited for this task?
Select an answer first
37foundation · easy
Which technique is commonly used to map the network topology of an ICS/SCADA environment?
Select an answer first
38application · medium
During an active footprinting engagement, an assessor needs to identify the firmware version of a specific RTU in a remote pumping station. The RTU is on a serial-to-Ethernet gateway. Which technique is most appropriate?
Select an answer first
39application · medium
A penetration tester is performing passive reconnaissance on a power utility. The tester wants to identify the physical locations of substations and the names of key engineering personnel. Which OSINT source would be most useful?
Select an answer first
40expert · hard
A security architect is designing countermeasures to reduce the risk of footprinting against a nuclear research facility's ICS. The facility is subject to strict regulatory requirements that limit what can be published. The architect must balance operational transparency with security. Which countermeasure is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.