Ethical Hacking Concepts and Scope CEH Practice Questions (Page 7)

Questions 31–32

1. 31expert · hard

   A company wants to assess its security posture. They have a limited budget and need to prioritize. They want to identify as many vulnerabilities as possible and also confirm whether a specific critical vulnerability is exploitable. Which approach is most cost-effective?

   • ARun a vulnerability scan to identify weaknesses, then perform a targeted penetration test on the critical vulnerability.
   • BConduct a full penetration test of the entire network.
   • CHire an ethical hacker to manually review the network and report findings.
   • DPerform a vulnerability scan only, and rely on the scan results to confirm exploitability.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial firm hires an ethical hacker to assess its external web application. The contract explicitly limits testing to the application's public-facing endpoints and prohibits any attempts to access internal administrative panels. During the assessment, the ethical hacker discovers a critical vulnerability that could allow access to the internal admin panel. What is the most appropriate action for the ethical hacker to take?

   • AContinue testing the admin panel but avoid changing any data, since the intent is to help the firm.
   • BExploit the vulnerability to prove the risk, then document the findings in the report.
   • CStop testing, report the vulnerability immediately, and request written authorization to expand the scope.
   • DIgnore the vulnerability because it is outside the scope and not relevant to the engagement.
   Reveal Solution Discussion Select an answer first