Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is hired to assess the security of a company. Before any active scanning, the tester wants to build a profile of the organization's network, including IP address ranges, domain names, and employee email formats. Which activity is most appropriate for this stage?

   • AExploiting a known vulnerability in the company's firewall
   • BConducting an active port scan of the company's external IP range
   • CSending a probe packet to the company's web server to check response headers
   • DPerforming passive footprinting using WHOIS, DNS lookups, and public records
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An ethical hacker is performing reconnaissance for a client. The hacker wants to gather information about the client's network without alerting the intrusion detection system (IDS). Which approach is most appropriate?

   • AUse active reconnaissance from multiple source IP addresses
   • BUse active reconnaissance with fragmented packets to bypass IDS
   • CUse passive reconnaissance techniques such as searching public records and social media
   • DUse active reconnaissance with slow port scans to evade detection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After identifying a critical vulnerability in a web application, you need to gain access to the underlying database to demonstrate the impact. You have a valid exploit that gives you a reverse shell. What is the immediate next step in the ethical hacking process?

   • ARun the exploit to gain initial access, then escalate privileges if needed
   • BReport the vulnerability to the client without exploiting it
   • CPerform a full vulnerability scan of the database server
   • DEnumerate all database usernames and passwords
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After scanning a network, you find that a Windows server has NetBIOS (ports 137-139) and SMB (port 445) open. You need to extract user accounts, group memberships, and shared resources to plan a password attack. Which tool is most appropriate for this task?

   • Aenum4linux, which is designed for SMB and NetBIOS enumeration
   • BMetasploit's exploit module for SMB
   • CWireshark to capture SMB traffic
   • DNmap with a service version scan
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main purpose of the scanning phase in ethical hacking?

   • ATo extract user credentials and shared resources from the target
   • BTo exploit vulnerabilities in the target's applications
   • CTo identify live hosts, open ports, and running services on the target network
   • DTo gather publicly available information about the target organization
   Reveal Solution Discussion Select an answer first