Scanning and Enumeration ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   You are mapping an electrical substation's network. A device on 10.10.5.20 responds to a TCP connection on port 20000 with the banner 'Schneider Electric - Modicon M340 - Firmware 2.5'. What is the most reliable way to confirm this device's role in the substation?

   • ARecord the banner and correlate it with the substation's asset inventory
   • BPing the device with a large ICMP packet to verify it is alive
   • CRun a vulnerability scan against the device to see if it has known CVEs
   • DSend a DNP3 read request to the device to query its point list
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You have completed a scan of a mining operation's OT network and need to produce a report for management. Which element is most important to include to communicate the risk?

   • AThe exact commands used during the scan
   • BA prioritized list of vulnerabilities with associated CVSS scores
   • CA list of all open ports and services
   • DThe names of the scanning tools
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is assessing a large electrical substation. The network has multiple vendors' devices: some use Modbus TCP, some use DNP3, and one uses OPC UA. The team has limited time and must enumerate all devices without causing any disruption. They have a list of IP addresses but no credentials. Which approach is most effective?

   • AUse a protocol-specific scanner for each protocol on the respective ports
   • BUse a passive network tap to capture traffic and infer devices
   • CUse a single generic TCP port scanner on all ports
   • DUse an aggressive Nmap scan with all scripts enabled
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester is enumerating a DNP3 network. The tester has identified a device with port 20000 open. Which action would provide the most information about the device's configuration?

   • ASend a DNP3 write request to change a setpoint
   • BSend a DNP3 read request for the device's internal indication (IIN) bits
   • CUse a web browser to access the device's HTTP interface on port 20000
   • DPerform a TCP connect scan on port 20000 to confirm it is open
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is enumerating a Modbus TCP network. The analyst has identified a device with port 502 open. Which next step would most effectively determine the device's function and supported function codes?

   • ARun a generic HTTP banner grab on port 502
   • BSend a Modbus read device identification request (function code 43)
   • CSend a Modbus write single coil request to test response
   • DPerform a TCP connect scan on port 502 to confirm it is open
   Reveal Solution Discussion Select an answer first