Ethical Hacking Concepts and Scope CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company wants to ensure that its new firewall rules are correctly implemented and that no unauthorized ports are open. They also want to know if a specific vulnerability in their web server can be exploited to gain a shell. Which set of activities best matches these requirements?

   • APerform a vulnerability scan of the firewall and web server, then run a penetration test to exploit the web server vulnerability.
   • BConduct a full penetration test of the entire network, including social engineering.
   • CReview the firewall configuration manually and rely on the vendor's security advisories for the web server.
   • DRun a port scan on the firewall and a vulnerability scan on the web server, but do not attempt exploitation.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company hires an ethical hacker to assess its internal network. The ethical hacker discovers that an employee is using a simple password that is easily guessable. The ethical hacker also finds that the company's wireless network uses WEP encryption. What should the ethical hacker do?

   • AIgnore the findings because they are not technical vulnerabilities.
   • BUse the weak password to access the employee's account and demonstrate the risk.
   • CChange the employee's password to a stronger one and update the wireless encryption to WPA2.
   • DReport both findings to the company, explaining the risks and recommending remediation.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is planning to assess a new application. The team has a limited time window and needs to identify as many vulnerabilities as possible. The team is considering whether to perform a vulnerability assessment or a penetration test. Which factor is most important in deciding between the two?

   • AThe number of vulnerabilities that can be identified.
   • BThe cost of the assessment.
   • CThe need to understand the real-world impact of vulnerabilities.
   • DThe time available for the assessment.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key role of an ethical hacker in relation to security awareness within an organization?

   • ATo educate employees on security best practices and potential threats
   • BTo conduct security awareness training for all employees
   • CTo act as a deterrent by publicizing their hacking activities
   • DTo monitor employee behavior and report violations to management
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An ethical hacker is hired to assess a healthcare organization's patient portal. During the assessment, they find a vulnerability that exposes patient medical records. The organization's legal team has not yet approved public disclosure. What is the ethical hacker's primary responsibility regarding this finding?

   • AReport the vulnerability to the organization's management and technical team, and follow the agreed disclosure process.
   • BSell the vulnerability information to a security vendor to fund further research.
   • CPublicly disclose the vulnerability to warn patients immediately, since it involves sensitive data.
   • DKeep the finding confidential until the next scheduled assessment, to avoid alarming the organization.
   Reveal Solution Discussion Select an answer first