Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A group of activists defaces a government website and replaces the homepage with a message protesting a new law. They do not steal data or cause permanent damage. Which hacker classification best fits this group?

   • AGray hat hackers, because they did not cause permanent damage.
   • BBlack hat hackers, because they performed an illegal act.
   • CScript kiddies, because they used automated tools to deface the site.
   • DHacktivists, because their actions are politically motivated.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company hires a security professional to test its new mobile app. The professional signs a contract that defines the scope, rules of engagement, and confidentiality. During the test, the professional discovers a critical vulnerability that could allow unauthorized access to user data. What is the most appropriate action for the professional to take?

   • AExploit the vulnerability to demonstrate the impact and then publish the findings publicly.
   • BDocument the vulnerability and report it to the company with remediation recommendations.
   • CReport the vulnerability to the app store and ask them to remove the app.
   • DStop testing and refuse to share the details until the company fixes the issue.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a primary goal of ethical hacking?

   • ATo identify vulnerabilities and improve overall security posture
   • BTo demonstrate the superiority of certain security tools
   • CTo create a detailed map of an organization's internal network
   • DTo exploit vulnerabilities for financial gain
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scenario best describes a gray hat hacker's behavior?

   • AAn individual who breaks into a company's server to prove a point and then informs them without asking for payment
   • BA hacker who steals credit card information to sell on the dark web
   • CA security consultant who has written permission to test a client's network
   • DA government agent who conducts cyber espionage for national security
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is planning an assessment of a critical application. The CIO wants a comprehensive evaluation of all security weaknesses, while the CISO wants to validate specific security controls. The budget allows for only one engagement. Which approach best satisfies both requirements?

   • APerform an ethical hacking engagement that includes vulnerability scanning, manual testing, and control validation.
   • BHire two separate teams: one for penetration testing and one for vulnerability assessment.
   • CRun a vulnerability scan and then fix the findings without manual testing.
   • DConduct a penetration test that focuses on exploiting the most critical vulnerabilities.
   Reveal Solution Discussion Select an answer first