Ethical Hacking Concepts and Scope CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company wants to understand its overall security posture by identifying a wide range of vulnerabilities across its network, including misconfigurations, missing patches, and weak passwords. They also want to validate whether a specific known exploit can actually be used to gain access to a critical server. Which approach best satisfies both objectives?

   • AConduct a full penetration test that attempts to exploit every discovered vulnerability.
   • BRun an ethical hacking assessment that includes social engineering and physical security checks.
   • CPerform a vulnerability scan only, and rely on the scan results to confirm exploitability.
   • DRun a vulnerability scanner to enumerate weaknesses, then perform a targeted penetration test on the critical server.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security professional is asked to test the security of a web application. The professional has no written contract or authorization from the application owner, but the request comes from a senior manager who verbally approves the test. What is the most appropriate action?

   • ATest the application but only for low-risk vulnerabilities to avoid causing damage.
   • BRefuse to test until written authorization is obtained from the application owner.
   • CAsk the manager to sign a non-disclosure agreement before testing.
   • DProceed with the test because the senior manager has authority.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization wants to assess its security by simulating an attack to see if a known vulnerability can be exploited to gain access to sensitive data. Which activity best fits this objective?

   • AVulnerability scanning
   • BPenetration testing
   • CRisk assessment
   • DSecurity audit
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security researcher discovers a critical vulnerability in a widely used software product. The researcher is not affiliated with the vendor and has no authorization to test the product. The researcher wants to disclose the vulnerability to the vendor to help fix it. What is the most appropriate action?

   • AExploit the vulnerability to demonstrate the risk to the vendor, then report it.
   • BSell the vulnerability information to a government agency for financial gain.
   • CPublicly disclose the vulnerability immediately to force the vendor to act.
   • DPrivately report the vulnerability to the vendor and allow a reasonable time for a fix before public disclosure.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retailer hires a security firm to test its public e-commerce site. The contract explicitly limits testing to the web application and its APIs, and prohibits any testing of the underlying database server or the corporate network. During the engagement, the tester discovers that the web app has a SQL injection flaw that could expose customer data from the database. What is the most appropriate action for the tester?

   • AStop testing the SQL injection and report the vulnerability as a finding without exploiting it further.
   • BContinue testing the database server because the SQL injection makes it part of the web application's attack surface.
   • CExploit the SQL injection to retrieve a small sample of data to prove the risk, then include it in the report.
   • DAsk the client for permission to test the database, and if denied, proceed anyway because the risk is critical.
   Reveal Solution Discussion Select an answer first