Intelligence Gathering and Footprinting ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What type of information is gathered during organizational footprinting of an ICS/SCADA target?

   • AThe operating system versions of the organization's servers
   • BThe IP addresses and subnet masks of the control network
   • CThe open ports on the organization's firewall
   • DThe names and roles of key personnel, such as control system engineers
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which OSINT method would be most effective for discovering internet-exposed SCADA devices without directly interacting with them?

   • ASending a broadcast ping to the target's subnet to identify live hosts
   • BUsing Shodan to search for devices with default ports or known SCADA protocols
   • CUsing Wireshark to capture traffic on the target's network segment
   • DRunning a vulnerability scanner like Nessus against the target's IP range
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security researcher is performing OSINT on a chemical plant to identify the types of safety systems in use. The researcher has no access to the plant's network. Which public source is most likely to reveal this information?

   • AEnvironmental regulatory reports that list process safety equipment and control systems
   • BThe plant's social media page with photos of the facility exterior
   • CA WHOIS lookup for the domain registrar
   • DA DNS lookup of the plant's domain
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A water utility has been the target of a footprinting campaign. An attacker used OSINT to identify the SCADA vendor, then used a phishing email to trick an employee into revealing the remote access VPN credentials. The utility wants to implement countermeasures to reduce the risk of future footprinting and social engineering. Which combination of countermeasures is most effective?

   • ARemoving all SCADA vendor information from the company website and social media
   • BUsing a VPN with a pre-shared key and changing it quarterly
   • CDeploying an email filtering solution to block phishing emails and a web filter to block access to social media
   • DImplementing multi-factor authentication (MFA) for VPN access and conducting regular security awareness training on phishing and OSINT risks
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An OT security analyst is footprinting a remote pumping station and needs to identify the make and model of a PLC that is reachable on the network. The analyst has permission to actively interact with the device. Which tool is specifically designed to query industrial protocols and enumerate device information?

   • AMetasploit's modbusclient auxiliary module
   • BShodan to search for the PLC's IP address in its database
   • CNmap with the --script=modbus-discover script
   • DWireshark to capture and decode Modbus TCP traffic on the network
   Reveal Solution Discussion Select an answer first