CPENT Iot And OT Exploitation Practice Question
An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'
Fingerprinting ICS equipment involves using Nmap NSE scripts tailored for industrial protocols or specialized asset discovery tools like Shodan/Industrial Defender tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters
Why it's wrong here
Aircrack-ng is for Wi-Fi, not Bluetooth Low Energy or ICS asset discovery.
- ✗
Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP
Why it's wrong here
Sqlmap targets relational databases, not ICS field devices or control protocols.
- ✗
Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list
Why it's wrong here
WPA2 cracking is used for wireless network auditing, not ICS asset discovery.
- ✓
Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'
Why this is correct
Nmap ICS scripts query specific OT ports to safely extract model numbers, firmware versions, and rack/slot data.
- ✓
Employing active asset discovery tools designed for OT environments (e.g., Nozomi Guardian, Claroty, or Dragos Platform)
Why this is correct
Passive and active OT monitoring platforms specialize in identifying industrial assets, firmware, and proprietary protocol behaviors.
About these practice questions
One of 274 original CPENT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.