Since direct interaction with the ICS application is restricted, the best way to analyze network traffic without modifying the system is to use port mirroring on a firewall or network switch.
* Option A (Port mirroring) #:
* Correct. Port mirroring (SPAN) copies network traffic without modifying the host system.
* Allows passive analysis of whether encryption is used.
* Option B (Packet capture on the server) #:
* Requires modifying the host, which is prohibited by the client.
* Option C (Reconfiguring the app to use a proxy) #:
* Modifies application settings, which violates the client's terms.
* Option D (Disabling certificate pinning) #:
* Requires changes to security settings, which is not allowed in this scenario.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - Passive Traffic Analysis for ICS Systems