A water treatment facility's OT network contains legacy PLCs that are known to crash when they receive malformed packets. The security team needs to identify live hosts and open ports without disrupting operations. Which approach best balances safety and completeness?

Run a full TCP connect scan with service version detection against all IP ranges

Perform a ping sweep with ICMP echo requests, then a TCP SYN scan on common ICS ports

Deploy an active vulnerability scanner with default settings to enumerate hosts and ports

Use a passive network tap to observe traffic, then conduct a slow TCP connect scan on only the discovered IPs

What is the primary goal of mapping an ICS/SCADA network topology?

To identify the physical location of every device

To determine the IP addresses of all external systems

To create a logical diagram of devices and their interconnections

To list all software vulnerabilities on each device

A penetration tester is assessing a food processing plant. The tester has identified a device with an open port 102 (S7comm) and another with port 44818 (EtherNet/IP). The tester needs to identify the exact firmware versions of both devices. The plant has strict change-control policies and cannot allow any write operations. Which technique is best?

Use a network sniffer to capture traffic and extract versions from packets

Use S7comm read-only requests to query the module identification and EtherNet/IP explicit messages to query the identity object

Use a generic banner grab on both ports

Use a vulnerability scanner that attempts to exploit the devices to reveal versions

During a scan of a manufacturing plant's OT network, a tester finds an open TCP port 44818. The tester wants to identify the device type and firmware version. Which technique is most appropriate?

Connect to port 44818 with a web browser to view the device's web interface

Run a UDP scan on port 44818 to see if the device responds

Use a tool that sends EtherNet/IP explicit messages to query the device's identity object

Send a Modbus read holding registers request to port 44818

After scanning a chemical plant's OT network, a security engineer has a list of IP addresses, open ports, and service banners. The engineer needs to create a logical network topology diagram. Which additional information is most critical to accurately map the network?

The communication paths and data flows between devices

The physical location of each device

The operating system version of each device

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 3

Scanning and Enumeration ICSSCADA Practice Questions (Page 3)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 11–15

11application · medium
A water treatment facility's OT network contains legacy PLCs that are known to crash when they receive malformed packets. The security team needs to identify live hosts and open ports without disrupting operations. Which approach best balances safety and completeness?
Select an answer first
12foundation · easy
What is the primary goal of mapping an ICS/SCADA network topology?
Select an answer first
13expert · hard
A penetration tester is assessing a food processing plant. The tester has identified a device with an open port 102 (S7comm) and another with port 44818 (EtherNet/IP). The tester needs to identify the exact firmware versions of both devices. The plant has strict change-control policies and cannot allow any write operations. Which technique is best?
Select an answer first
14application · medium
During a scan of a manufacturing plant's OT network, a tester finds an open TCP port 44818. The tester wants to identify the device type and firmware version. Which technique is most appropriate?
Select an answer first
15application · medium
After scanning a chemical plant's OT network, a security engineer has a list of IP addresses, open ports, and service banners. The engineer needs to create a logical network topology diagram. Which additional information is most critical to accurately map the network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.