Scanning and Enumeration ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During the scanning phase of an ICS/SCADA security assessment, which technique is most appropriate for identifying active hosts on a control network without causing excessive traffic or disruption?

   • ATCP SYN scan on common ports
   • BARP scan on the local subnet
   • CUDP scan on all ports
   • DPing sweep using ICMP echo requests
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is scanning a natural gas pipeline's OT network. They need to identify all active hosts and the services they run. The network is segmented into several VLANs. Which scanning strategy is most effective?

   • ADeploy scanning agents on each VLAN to scan locally
   • BUse a passive network tap to capture traffic instead of active scanning
   • CScan each VLAN from a single point in the network
   • DScan only the management VLAN and assume other VLANs are similar
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is scanning a remote oil pumping station that is connected to the main control center via a satellite link with limited bandwidth. The team needs to identify all devices and services on the remote network. The scan must be completed within a 30-minute window and must not saturate the link. Which approach is best?

   • AUse a passive network tap at the remote site and send all captured traffic back
   • BDeploy a temporary scanning appliance on-site to scan locally and send only the results back
   • CUse a fast scan with a limited port range from the main control center
   • DRun a scan from the main control center over the satellite link
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which port scanning technique is considered less intrusive and is often preferred for initial reconnaissance in an ICS/SCADA network because it does not complete the TCP handshake?

   • ATCP SYN scan
   • BTCP connect scan
   • CACK scan
   • DUDP scan
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   A security consultant has completed a comprehensive scan of a refinery's OT network. The scan identified several Modbus devices with unknown function codes, a DNP3 device with a known vulnerability, and an OPC server with an outdated version. The consultant must document the findings for the client. Which elements should be included in the documentation? Select all that apply.

   • AThe recommended remediation steps for each finding
   • BThe CVE ID and CVSS score for the DNP3 vulnerability
   • CThe specific function codes observed on Modbus devices
   • DThe name of the network administrator
   • EThe IP address and port of each device
   Check answers Discussion Select an answer first