Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   You are performing a penetration test and have identified that a Windows domain controller is running SMB. You need to enumerate domain users and group policies to plan a lateral movement attack. However, you must avoid locking out accounts or triggering account lockout policies. Which enumeration technique is most appropriate?

   • AUse a brute-force tool to try many passwords for a single user
   • BUse anonymous SMB enumeration to query user lists and group policies without authentication attempts
   • CUse a password-spraying tool to test a few common passwords against all users
   • DUse a vulnerability scanner to check for SMB vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is performing footprinting on a target organization. The analyst has gathered the organization's domain name, IP address range, employee names, and email formats from public records and social media. What type of information has the analyst collected?

   • AOpen ports and running services
   • BPublicly available organizational and technical data
   • CNetwork topology and firewall rules
   • DSystem usernames and passwords
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the ethical hacking process, what is the primary purpose of the reconnaissance phase?

   • ATo scan for open ports and running services on the target
   • BTo identify and document vulnerabilities in the target system
   • CTo actively exploit vulnerabilities in the target system
   • DTo gather as much information as possible about the target before any active engagement
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester has identified a target server running multiple services. The tester wants to extract as much information as possible from the services to plan an attack, but the client has limited time and wants to minimize the risk of detection. Which approach should the tester take?

   • ASkip enumeration and proceed directly to exploitation
   • BEnumerate all services sequentially, starting with the least important
   • CEnumerate only the services that are most likely to yield valuable information
   • DEnumerate all services in parallel to save time
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is scanning a target network that has a strict firewall that drops all ICMP traffic. The tester needs to identify live hosts and open ports, but the firewall is also configured to log all connection attempts. Which scanning technique should the tester use to minimize detection while still achieving the goal?

   • APerform a full TCP connect scan on all ports
   • BPerform a UDP scan on all ports
   • CPerform a ping sweep using ICMP echo requests
   • DPerform a TCP SYN scan on common ports without a ping sweep
   Reveal Solution Discussion Select an answer first