nerdexam
EC-Council

312-50V12 · Question #30

Jim, a professional hacker, targeted an organization that is operating critical industrial infrastructure. Jim used Nmap to scan open ports and running services on systems connected to the organizatio

The correct answer is B. nmap -Pn -sU -p 44818 --script enip-info < Target IP >. This question tests knowledge of Nmap scripts used to enumerate industrial control system (ICS) protocols, specifically EtherNet/IP used in OT environments.

Submitted by carter_n· Mar 4, 2026Wireless Network, Mobile, IoT, and OT Hacking

Question

Jim, a professional hacker, targeted an organization that is operating critical industrial infrastructure. Jim used Nmap to scan open ports and running services on systems connected to the organization's OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered information such as the vendor name, product code and name, device name, and IP address. Which of the following Nmap commands helped Jim retrieve the required information?

Options

  • Anmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP >
  • Bnmap -Pn -sU -p 44818 --script enip-info < Target IP >
  • Cnmap -Pn -sT -p 46824 < Target IP >
  • Dnmap -Pn -sT -p 102 --script s7-info < Target IP >

How the community answered

(42 responses)
  • A
    12% (5)
  • B
    81% (34)
  • C
    2% (1)
  • D
    5% (2)

Why each option

This question tests knowledge of Nmap scripts used to enumerate industrial control system (ICS) protocols, specifically EtherNet/IP used in OT environments.

Anmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP >

This command performs a generic TCP scan with rate-limiting options (scan-delay and max-parallelism) designed for stealthy scanning of a port list, but lacks any ICS-specific script or the correct EtherNet/IP port to retrieve vendor or device information.

Bnmap -Pn -sU -p 44818 --script enip-info < Target IP >Correct

EtherNet/IP (Ethernet Industrial Protocol) operates over UDP port 44818, and the Nmap script 'enip-info' is specifically designed to query EtherNet/IP devices and retrieve detailed information including vendor name, product code, product name, device name, and IP address. The '-sU' flag specifies a UDP scan, which is required since EtherNet/IP device discovery uses UDP on port 44818, making this the exact command to enumerate such OT devices.

Cnmap -Pn -sT -p 46824 < Target IP >

Port 46824 is not a standard EtherNet/IP port, and this command includes no Nmap script to extract device metadata such as vendor name or product code from OT devices.

Dnmap -Pn -sT -p 102 --script s7-info < Target IP >

The '-p 102' with '--script s7-info' targets Siemens S7 PLCs using the S7comm protocol over TCP port 102, which is specific to Siemens SIMATIC devices and not EtherNet/IP devices from other vendors.

Concept tested: Nmap EtherNet/IP enumeration in OT networks

Source: https://nmap.org/nsedoc/scripts/enip-info.html

Topics

#OT network hacking#Nmap scripting#Ethernet/IP devices#ICS/SCADA

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice