312-50 Question 420
Single answer▪ OT ConceptsDuring an authorized assessment of a water treatment plant, you are asked to identify PLCs, HMIs, and engineering workstations on the OT network without disrupting operations. The plant manager is concerned that active scanning could interfere with legacy controllers. Which approach is MOST appropriate for the initial discovery phase?
- A
Connect a laptop to the OT switch and run an aggressive Nmap scan with OS detection and version enumeration across the entire subnet
- B
Use passive network monitoring on a SPAN/mirror port to observe ICS protocols and asset communications before performing any limited, approved active validation
- C
Send repeated Modbus function code requests to every device to determine unit IDs, firmware versions, and writable registers
- D
Deploy a vulnerability scanner configured with default safe checks because OT devices generally respond like IT hosts
Show answer and explanation
Correct answer: B
Explanation
In OT environments, the primary concern is preserving safety and availability. Unlike traditional IT networks, many industrial devices are legacy, timing-sensitive, and not designed to tolerate broad active scanning. A passive discovery approach using a SPAN/mirror port is generally the safest and most operationally sound starting point for identifying PLCs, HMIs, engineering workstations, and protocol flows. After building an asset inventory passively, the assessor can coordinate any narrowly scoped active checks with plant personnel.
This approach is consistent with widely accepted OT/ICS guidance, including NIST SP 800-82, which emphasizes minimizing operational impact in ICS environments, and the Purdue-style separation mindset commonly used in industrial architectures. The key CEH-relevant concept is understanding that techniques acceptable in enterprise IT may be risky in OT, so reconnaissance must be adapted to the operational constraints of industrial systems.
- A. Incorrect.
This is inappropriate for an OT environment, especially during initial discovery. Aggressive Nmap techniques such as OS detection, service/version enumeration, and broad probing can generate unexpected traffic patterns that legacy PLCs, RTUs, or embedded HMIs may not handle well. In OT, availability and safety take priority, so uncontrolled active scanning is typically avoided until the environment is understood and explicit approval is obtained.
- B. Correct.
This is the best initial approach. Passive monitoring from a SPAN/mirror port allows the assessor to identify devices, communication relationships, and industrial protocols such as Modbus/TCP, DNP3, EtherNet/IP, or PROFINET without directly interrogating field devices. This aligns with OT security best practices that prioritize safety, reliability, and minimal operational impact. After passive identification, any active validation should be narrow, approved, and coordinated with operations staff.
- C. Incorrect.
This is unsafe and not an appropriate initial method. Repeatedly sending Modbus requests to all devices is active interrogation and may affect fragile or poorly documented controllers. It can also generate unintended behavior if unsupported or improperly formed requests are sent. While protocol-aware validation may sometimes be used in tightly controlled circumstances, it should not be the default first step in a production OT network.
- D. Incorrect.
This reflects a common IT-to-OT misconception. Even when a scanner offers 'safe checks,' OT devices do not necessarily behave like standard IT hosts, and embedded systems may still react poorly to scans, malformed packets, or excessive traffic. OT assessments usually require vendor guidance, strict change control, maintenance windows where needed, and a preference for passive asset discovery first.