Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   You are conducting a security assessment for a client with a legacy network that has many unstable services. The client requires you to identify open ports and services, but you must avoid crashing any services. You have a list of IP addresses and need to scan efficiently. Which approach is most appropriate?

   • AUse a TCP SYN scan with a slow timing template (e.g., -T2) to reduce load and avoid incomplete handshakes
   • BUse a UDP scan to avoid TCP-related issues
   • CUse a full TCP connect scan with default timing to ensure accuracy
   • DUse a ping sweep to identify live hosts and skip port scanning
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You have discovered that a web server is running an application that allows user enumeration through its login error messages. You want to collect a list of valid usernames to use in a later credential-stuffing attack. Which phase and technique is this?

   • AScanning, by running a directory brute-force tool
   • BVulnerability analysis, by checking the application against OWASP Top 10
   • CExploitation, by using SQL injection to dump the user database
   • DEnumeration, by automating login attempts to observe different error messages
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester has completed scanning and enumeration of a target network. The tester has identified several potential vulnerabilities, but the client has limited time and budget. The tester must prioritize which vulnerabilities to exploit first to demonstrate the highest business impact. Which approach should the tester take?

   • AExploit the vulnerability that is easiest to exploit, even if it affects a low-value asset.
   • BExploit all identified vulnerabilities in parallel to save time.
   • CPrioritize vulnerabilities that affect critical assets and have a high likelihood of exploitation.
   • DExploit the vulnerability with the highest CVSS score first, regardless of the asset value.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which phase of ethical hacking involves collecting information about a target without actively engaging its systems?

   • AScanning
   • BReconnaissance
   • CExploitation
   • DEnumeration
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is in the footprinting phase and has collected the target's domain name, IP address range, and employee email addresses from public sources. What additional information could the tester gather during footprinting to further profile the target?

   • APhysical security measures and employee names
   • BUser credentials and password hashes
   • COpen ports and services
   • DOperating system and application versions
   Reveal Solution Discussion Select an answer first