Scanning and Enumeration ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A pharmaceutical company's OT network includes a mix of modern and legacy devices. The security team must identify known vulnerabilities but cannot risk interrupting production. Which scanning strategy is most appropriate?

   • ARun a full vulnerability scan with default credentials and aggressive plugins
   • BPerform a comprehensive port scan on all devices and manually check for known CVEs
   • CUse a passive vulnerability scanner that analyzes traffic and compares to CVE databases
   • DDisable all firewalls and run an external scan from the corporate network
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During an assessment of a refinery's OT network, you find a device on TCP port 20000 that responds to DNP3 requests. The asset inventory lists it as a Modbus device. You need to confirm the device's role without causing disruption. What is the best approach?

   • AQuery the DNP3 device's point list and compare it with the asset inventory
   • BUse a BACnet read request to query the device's points
   • CRun a vulnerability scan against the device to see if it has known CVEs
   • DSend a Modbus read request to port 502
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During a scan of a chemical plant, you find a device on TCP port 102 with a banner that says 'Siemens S7-300'. You need to confirm the device's role in the production line, but the plant's safety system prohibits any write operations. Which action is most appropriate?

   • AUse a DNP3 read command to query the device's data points
   • BSend a S7comm write request to a memory location to test the device's response
   • CPerform a full port scan on the device to identify all open ports
   • DUse the S7comm protocol to read the device's block information and module status
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester is assessing a water treatment facility. The tester needs to identify live hosts and open ports on the OT network without disrupting critical processes. The tester has been given a list of known IP ranges but no credentials. Which approach best balances safety and effectiveness?

   • AUse an aggressive Nmap scan with OS detection and version detection on all ports
   • BPerform a ping sweep to find live hosts, then a SYN scan on common ICS ports
   • CScan only the IT network and infer OT devices from IT inventory
   • DRun a full TCP connect scan on all ports of every IP in the ranges
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A power utility's OT network has a strict change-management policy: any active scan that sends more than 10 packets per second to a single device must be approved by the engineering team. You need to map the network and identify vulnerabilities, but you have only a 2-hour maintenance window. Which approach best meets the constraint?

   • ARun a full active scan at 5 packets per second across all IP ranges
   • BUse a network tap to capture traffic for 24 hours and analyze it later
   • CRun a passive scan for the full 2 hours and then perform a slow active scan on only the discovered devices
   • DRun a vulnerability scanner with default settings and hope it stays under the rate limit
   Reveal Solution Discussion Select an answer first