Ethical Hacking Concepts and Scope CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement accurately differentiates ethical hacking from penetration testing?

   • AEthical hacking is performed only by external consultants, while penetration testing is performed by internal staff
   • BPenetration testing is a legal activity, while ethical hacking is not
   • CEthical hacking is a broader term that includes various security assessments, while penetration testing is a specific type of assessment focused on exploiting vulnerabilities
   • DEthical hacking always involves social engineering, while penetration testing never does
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes the scope of an ethical hacking engagement?

   • AAny system that the ethical hacker can access using publicly available information
   • BOnly the external-facing systems, as internal systems are not part of ethical hacking
   • CThe entire organization's network, including all systems and applications, without any restrictions
   • DThe specific systems, networks, and applications that the organization has authorized the ethical hacker to test
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What primarily distinguishes an ethical hacker from a malicious hacker?

   • AThe use of automated tools versus manual techniques
   • BThe target being a corporate network rather than a personal device
   • CThe level of technical skill and the tools used
   • DThe intent and authorization behind the hacking activities
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is hired to assess a company's web application. The contract specifies that testing must not cause any service disruption. During the test, the tester finds a vulnerability that, if exploited, could cause a denial of service. The tester also finds a separate vulnerability that could allow data exfiltration. The client wants both vulnerabilities confirmed. What is the most appropriate course of action?

   • ADocument both vulnerabilities without exploiting either, to stay within the contract.
   • BExploit the DoS vulnerability during off-peak hours to minimize impact.
   • CExploit the data exfiltration vulnerability to confirm it, and document the DoS vulnerability without exploiting it.
   • DExploit both vulnerabilities to provide complete confirmation, since the client wants them confirmed.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An ethical hacker is engaged to test a company's external perimeter. The rules of engagement specify that testing must not cause denial of service. During the test, the hacker finds a vulnerability that, if exploited, could crash a public-facing web server. What should the hacker do?

   • AExploit the vulnerability during off-peak hours to minimize impact.
   • BDocument the vulnerability without exploiting it, and explain the potential impact in the report.
   • CAsk the client for permission to crash the server, then proceed if approved.
   • DExploit the vulnerability to confirm the crash, then report it.
   Reveal Solution Discussion Select an answer first