Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A white hat hacker is hired to assess the security of a financial institution. During the engagement, she discovers an unrelated vulnerability in a third-party payment processor. What should she do to stay within ethical and legal boundaries?

   • ADocument the finding and inform the client, then let the client decide how to handle it.
   • BIgnore the vulnerability because it is outside the scope of the assessment.
   • CReport the vulnerability to the third-party processor without the client's knowledge.
   • DExploit the third-party vulnerability to see if it affects the financial institution.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which outcome best reflects the goal of ethical hacking?

   • AA demonstration that all security controls are ineffective
   • BA public disclosure of all discovered vulnerabilities
   • CA collection of stolen credentials for later use
   • DA detailed report of exploitable weaknesses with remediation recommendations
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A white hat hacker is conducting an authorized penetration test for a client. During the test, she finds a critical vulnerability that could allow an attacker to access customer data. The client asks her to keep the vulnerability secret until they can fix it, but the law in their jurisdiction requires disclosure of data breaches. What should the hacker do?

   • ADisclose the vulnerability to the public immediately to protect customers.
   • BResign from the engagement to avoid legal liability.
   • CInform the client that she must comply with legal disclosure requirements and work with them to report it appropriately.
   • DFollow the client's request and keep the vulnerability secret.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does a gray hat hacker differ from a white hat hacker?

   • AGray hats may operate without authorization but without malicious intent
   • BGray hats always have malicious intent
   • CGray hats always disclose vulnerabilities to the vendor first
   • DGray hats only target government systems
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is conducting an ethical hacking engagement for a client. They have identified several vulnerabilities and are preparing the final report. What is the most important element to include in the report to help the client improve their security posture?

   • AA list of all the tools used during the engagement.
   • BA summary of the tester's qualifications and experience.
   • CA timeline of the testing activities.
   • DA detailed description of each vulnerability and recommended remediation steps.
   Reveal Solution Discussion Select an answer first