Scanning and Enumeration ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which ICS/SCADA protocol is commonly used in electrical power systems for communication between master stations and remote terminal units (RTUs) and supports time-stamped events?

   • ADNP3
   • BOPC
   • CEtherNet/IP
   • DModbus
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a recommended practice when documenting scan findings for an ICS/SCADA assessment?

   • AStore findings in a single unstructured text file
   • BShare findings only verbally with the operations team
   • CInclude timestamps, device identifiers, and the specific scan results
   • DRecord only the IP addresses of devices with critical vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security consultant has completed a scan of a pharmaceutical plant's OT network and is preparing the final report. The report must be useful to both management and technical staff. Which format is most effective?

   • AA verbal presentation with no written documentation
   • BA single table listing all IP addresses, ports, and vulnerabilities
   • CA technical report with raw scan output only
   • DAn executive summary with high-level findings and a technical appendix with detailed scan data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When performing vulnerability scanning in an ICS/SCADA environment, what is a critical operational constraint to consider?

   • AThe scan cannot be performed on legacy systems
   • BThe scan will always require physical access to the devices
   • CThe scan must be performed during peak production hours to get accurate results
   • DThe scan may cause disruption to critical processes
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A vulnerability assessment is required for a hospital's building management system (BMS) that controls HVAC and elevators. The BMS uses BACnet and Modbus. The hospital cannot tolerate downtime. The assessment must identify vulnerabilities in both protocols. Which strategy is best?

   • ARun an active scan with all vulnerability checks enabled
   • BRun an active scan only on the BACnet devices and skip Modbus
   • CRun a passive vulnerability assessment using network monitoring for a week, then analyze the data
   • DRun an active vulnerability scan with a fast timing template to minimize duration
   Reveal Solution Discussion Select an answer first