Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a limited security budget and must choose between a penetration test and a vulnerability scan. The company's main concern is meeting compliance requirements that mandate regular vulnerability scanning. However, the security team believes a penetration test would provide more valuable insights. What is the best decision?

   • AConduct both, even if it exceeds the budget, to get the best security outcome.
   • BConduct the penetration test instead, as it provides more value than a scan.
   • CConduct the vulnerability scan to meet compliance, and use the results to prioritize a future penetration test.
   • DSkip both and rely on the security team's manual code review.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which hacker type is typically sponsored by a government to conduct cyber espionage?

   • AState-sponsored hacker
   • BGray hat
   • CHacktivist
   • DScript kiddie
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which hacker type is characterized by using pre-written tools and scripts with little technical knowledge?

   • AGray hat
   • BHacktivist
   • CWhite hat
   • DScript kiddie
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team notices a series of attacks against its public website. The attacks use well-known exploit tools and scripts that are freely available online. The attacker does not appear to understand the underlying vulnerabilities and is simply running the tools with default settings. How should the team classify this attacker?

   • ABlack hat hacker, because the attacks are illegal.
   • BGray hat hacker, because the attacker is not causing damage.
   • CHacktivist, because the attacker is using publicly available tools.
   • DScript kiddie, because the attacker is using existing tools without deep technical knowledge.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration testing firm is hired to test a client's web application. The contract includes a clause that allows the firm to test any system that is 'related' to the application. During the test, the tester discovers a vulnerability in the client's database server, which is not explicitly listed in the scope but is used by the application. What should the tester do?

   • ATest the database server because it is related to the application.
   • BIgnore the database server because it is not explicitly listed.
   • CTest the database server and document the findings as out-of-scope.
   • DStop testing and ask the client for clarification on the scope.
   Reveal Solution Discussion Select an answer first