Ethical Hacking Fundamentals and Hacker Classes ECSS Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   A security team is investigating a series of attacks on their infrastructure. The attacks are highly sophisticated, use zero-day exploits, and appear to be funded by a foreign government. The attackers are not seeking financial gain but are stealing intellectual property. Which hacker classification best describes the attackers?

   • AHacktivists, because they are stealing information for political purposes.
   • BState-sponsored hackers, because they are funded by a government and target intellectual property.
   • CBlack hat hackers, because they are performing illegal activities.
   • DScript kiddies, because they are using zero-day exploits.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the key difference between ethical hacking and malicious hacking?

   • AMalicious hacking only targets large organizations
   • BEthical hacking uses more advanced tools than malicious hacking
   • CEthical hacking never causes any disruption to systems
   • DEthical hacking is performed with authorization and a constructive intent
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A small business wants to improve its security posture but has a limited budget. They have already run a vulnerability scanner and fixed the reported issues. What is the most valuable next step to achieve the goal of identifying vulnerabilities that automated scanners might miss?

   • APerform a manual penetration test to validate and exploit the findings.
   • BTrain employees on security awareness.
   • CPurchase additional security software to block attacks.
   • DRun the vulnerability scanner again with more aggressive settings.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A healthcare organization wants to verify that its new patient portal is resistant to common web attacks. The security team has been asked to identify as many vulnerabilities as possible across the entire application, including business logic flaws, and to provide a detailed report with remediation guidance. Which type of engagement best matches this request?

   • APenetration test, because the team will attempt to exploit the portal.
   • BEthical hacking assessment, because the goal is to comprehensively identify vulnerabilities and improve security.
   • CSecurity audit, because the team will review compliance with regulations.
   • DVulnerability scan, because the team will use automated tools.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A freelance security researcher finds a vulnerability in a popular e-commerce platform. Without permission, he accesses a test account to confirm the flaw, then publishes the details on his blog to pressure the company to fix it. He does not steal any data. Which statement best describes the ethical and legal status of his actions?

   • AHe is a hacktivist because he is using his skills to promote a social cause.
   • BHe is a white hat hacker because his goal is to improve security.
   • CHe is a gray hat hacker, but his actions may still violate computer fraud laws.
   • DHe is a black hat hacker because he published the vulnerability publicly.
   Reveal Solution Discussion Select an answer first