Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security consultant is beginning an authorized penetration test for a client. The client has asked the consultant to avoid any activity that could be detected by their network monitoring team during the initial information-gathering stage. The consultant needs to collect employee names, email formats, and technology stack details from public sources. Which approach should the consultant use?

   • AInitiate a TCP connect scan on the client's firewall to map allowed services.
   • BConduct a vulnerability scan using an automated tool against the client's web application.
   • CPerform active scanning of the client's public IP range to identify live hosts and open ports.
   • DUse search engines, social media, and public DNS records to gather information without directly interacting with the target systems.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is tasked with identifying weaknesses in a network before an external attacker can exploit them. The analyst has already completed scanning and enumeration. What should the analyst do next to prioritize which vulnerabilities to address first?

   • APerform vulnerability analysis by correlating scan results with known CVE databases and assigning risk ratings
   • BImmediately exploit the most critical vulnerability to prove impact
   • CRepeat the scanning phase with more aggressive settings
   • DBegin remediation by patching all identified vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of information is typically extracted during the enumeration phase?

   • AUser accounts, group memberships, and shared network resources
   • BThe exact version of the operating system and installed patches
   • COpen ports and the services running on them
   • DPublicly available information like domain names and IP ranges
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   You are conducting a vulnerability assessment for a web application. After scanning, you find that the server is running Apache 2.4.49, which is vulnerable to a path traversal and remote code execution (CVE-2021-41773). You need to confirm whether the vulnerability is actually exploitable in this specific configuration. What should you do next?

   • AAttempt a controlled exploit in a staging environment that mirrors the production configuration
   • BRun a full port scan to identify other open ports on the server
   • CImmediately patch the production server to the latest version
   • DReport the CVE as a confirmed vulnerability without further testing
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary goal of the exploitation phase in ethical hacking?

   • ATo identify all vulnerabilities present in the target system
   • BTo map the target's network and identify live hosts
   • CTo gain unauthorized access to the target system by leveraging identified vulnerabilities
   • DTo gather information about the target without being detected
   Reveal Solution Discussion Select an answer first