Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security researcher discovers a vulnerability in a popular software product. Without obtaining permission from the vendor, the researcher exploits the vulnerability to access a test server and then publicly discloses the vulnerability to pressure the vendor to fix it. The researcher did not cause any damage or steal data. How should this researcher be classified?

   • AWhite hat hacker, because the researcher disclosed the vulnerability responsibly.
   • BHacktivist, because the researcher wanted to pressure the vendor.
   • CGray hat hacker, because the researcher acted without authorization but with the intent to improve security.
   • DBlack hat hacker, because the researcher accessed a system without permission.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security consultant is hired to test a client's network. The contract specifies that the consultant must not access any personally identifiable information (PII). During the test, the consultant discovers a vulnerability that could expose PII. What should the consultant do?

   • AReport the vulnerability to the client immediately without accessing the PII.
   • BAccess the PII to prove the impact of the vulnerability.
   • CReport the vulnerability in the final report without immediate notification.
   • DIgnore the vulnerability because it is outside the agreed scope.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which hacker category is characterized by performing attacks without authorization but without malicious intent?

   • AGray hat
   • BWhite hat
   • CBlack hat
   • DScript kiddie
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which principle is a core part of an ethical hacker's code of conduct?

   • AUse any means necessary to test security, even if it causes downtime
   • BOperate within the scope defined by the client and maintain confidentiality
   • CAlways disclose all vulnerabilities publicly as soon as they are found
   • DShare findings with other hackers to gain recognition
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a mature security program and wants to validate that specific security controls are working as intended. They have already conducted a comprehensive vulnerability assessment. What type of engagement should they conduct next to meet this specific need?

   • AA security awareness training for employees.
   • BAnother vulnerability assessment to confirm the previous findings.
   • CA penetration test that attempts to exploit the vulnerabilities to see if the controls prevent exploitation.
   • DA compliance audit to ensure the controls meet regulatory standards.
   Reveal Solution Discussion Select an answer first