A water utility's SCADA network uses both Modbus TCP and DNP3. You have discovered a device on TCP port 502 that responds to Modbus function code 3, but the asset inventory lists it as a DNP3 device. What is the most likely explanation?

The asset inventory is outdated and the device was replaced with a Modbus device

The device is misconfigured and should be on port 20000

The scan result is a false positive

The device is a protocol gateway that translates between Modbus and DNP3

A consultant has completed a scan of a water utility's SCADA network and found several Modbus devices with unknown function codes. The consultant needs to document the findings for a report. What is the most important information to include for each device?

The IP address, port, and the specific function codes that were observed

The MAC address and the physical location of the device

The vendor and model of the device only

The network administrator's contact information

What is the primary purpose of banner grabbing in an ICS/SCADA environment?

To map the physical location of ICS devices

To determine the network topology of the ICS environment

To bypass authentication on ICS devices

To identify the operating system and application versions running on a device

A vulnerability assessment is planned for a power utility's SCADA network. The network contains legacy Windows 2000 workstations and modern RTUs. The assessment must identify known vulnerabilities without causing outages. Which approach is most appropriate?

Use a vulnerability scanner with default credentials to test for weak passwords

Run an unauthenticated scan with active exploit attempts to verify vulnerabilities

Scan only the IT systems and assume OT systems are isolated

Run an authenticated vulnerability scan with a read-only account on all systems

Why is it important to document scan findings in an ICS/SCADA security assessment?

To replace the need for continuous monitoring

To provide a basis for remediation planning and future comparisons

To satisfy legal requirements for all ICS networks

To automatically patch identified vulnerabilities

EC-CouncilICS/SCADA Cybersecurity

Domain 3Objective 3

Scanning and Enumeration ICSSCADA Practice Questions (Page 4)

Part of the Introduction to Hacking ICS/SCADA domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 16–20

16expert · hard
A water utility's SCADA network uses both Modbus TCP and DNP3. You have discovered a device on TCP port 502 that responds to Modbus function code 3, but the asset inventory lists it as a DNP3 device. What is the most likely explanation?
Select an answer first
17application · medium
A consultant has completed a scan of a water utility's SCADA network and found several Modbus devices with unknown function codes. The consultant needs to document the findings for a report. What is the most important information to include for each device?
Select an answer first
18foundation · easy
What is the primary purpose of banner grabbing in an ICS/SCADA environment?
Select an answer first
19application · medium
A vulnerability assessment is planned for a power utility's SCADA network. The network contains legacy Windows 2000 workstations and modern RTUs. The assessment must identify known vulnerabilities without causing outages. Which approach is most appropriate?
Select an answer first
20foundation · easy
Why is it important to document scan findings in an ICS/SCADA security assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.