Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is analyzing a sophisticated attack on a critical infrastructure provider. The attack used zero-day exploits and custom malware, and the attackers spent months mapping the network. The attack appears to be politically motivated and aimed at disrupting operations. The team has no evidence of financial gain. Which classification best fits this attacker?

   • AState-sponsored hacker, because the attack is sophisticated, politically motivated, and targeted at critical infrastructure.
   • BScript kiddie, because the attack used zero-day exploits.
   • CBlack hat hacker, because the attack is illegal.
   • DHacktivist, because the attack is politically motivated.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A healthcare organization wants to verify that its new patient portal cannot be breached. They have a limited budget and need a broad assessment of security weaknesses, not just a validation of specific controls. Which type of engagement best fits this need?

   • AAn ethical hacking engagement that includes vulnerability scanning, manual testing, and social engineering simulations.
   • BA configuration review of the firewall and load balancer only.
   • CA compliance audit that checks the portal against HIPAA requirements.
   • DA penetration test focused on exploiting a known vulnerability in the web server.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security firm is hired to test a client's network. The contract specifies the exact IP ranges and systems that may be tested. During the assessment, a tester discovers a critical vulnerability on a server that is NOT in the contract. What should the tester do?

   • AStop testing and report the vulnerability to the client as an out-of-scope finding.
   • BAdd the server to the test scope without telling the client to avoid delays.
   • CTest the server because the vulnerability is critical and the client would want to know.
   • DIgnore the vulnerability because it is out of scope.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best defines ethical hacking?

   • AUnauthorized probing of systems to find exploitable vulnerabilities for personal gain
   • BPerforming security assessments only after a security breach has occurred
   • CAuthorized attempts to identify and fix security weaknesses in systems and networks
   • DUsing publicly available tools to test systems without any formal permission
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company wants to ensure that its security testing is conducted in a way that is both legal and ethical. They are considering hiring an external firm. Which practice is most essential to ensure the testing is ethical?

   • AThe firm has a signed contract that defines the scope and authorization.
   • BThe firm uses the same tools as attackers.
   • CThe firm agrees to keep all findings confidential.
   • DThe firm promises to find all vulnerabilities.
   Reveal Solution Discussion Select an answer first