Ethical Hacking Concepts and Scope CEH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An ethical hacker is conducting an authorized assessment of a company's internal network. During the test, she discovers a critical vulnerability in a legacy payroll application that could allow an attacker to modify salary data. She also notices that the company's firewall logs show an ongoing brute-force attack from an external IP. What should she do first?

   • AIgnore the brute-force attack because it is not part of the assessment scope.
   • BImmediately block the external IP address on the firewall to stop the attack.
   • CReport the brute-force attack to the client's incident response team and continue the assessment.
   • DPause the assessment and use the payroll vulnerability to access the database and verify the impact.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An ethical hacker is hired to test a company's network. During the assessment, the hacker finds a vulnerability that could allow an attacker to access customer data. The hacker also discovers that the company is not compliant with data protection regulations. What should the hacker do?

   • AIgnore the compliance issue because it is not a technical vulnerability.
   • BReport the vulnerability to the regulatory authority because the company is non-compliant.
   • CReport the vulnerability and the compliance issue to the company.
   • DExploit the vulnerability to demonstrate the impact and then report it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company hires an ethical hacker to test its network security. The contract includes a clause that allows the hacker to use any means necessary to gain access. However, the company also has a policy that prohibits the use of social engineering against employees. What should the hacker do?

   • AAsk the company to change the policy to allow social engineering.
   • BUse social engineering because the contract allows any means necessary.
   • CAvoid social engineering and use only technical methods.
   • DUse social engineering but only against non-employees.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An ethical hacker is conducting an assessment for a client. During the test, the hacker discovers a critical vulnerability that could be exploited by a malicious actor. The client's management is aware of the vulnerability but has decided not to fix it immediately due to budget constraints. What should the ethical hacker do?

   • ARefuse to complete the assessment until the client fixes the vulnerability.
   • BFix the vulnerability without the client's permission.
   • CPublicly disclose the vulnerability to pressure the client into fixing it.
   • DRespect the client's decision and document the risk in the final report.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is it essential for an ethical hacker to adhere strictly to the defined scope of an engagement?

   • ATo prevent unauthorized access and potential legal consequences
   • BTo avoid detection by intrusion detection systems
   • CTo reduce the need for detailed documentation of findings
   • DTo ensure that the testing is completed within the allotted time frame
   Reveal Solution Discussion Select an answer first