Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security consultant is performing reconnaissance on a target organization. The consultant wants to gather information about the organization's network infrastructure without sending any packets to the target's systems. Which technique should the consultant use?

   • APassive reconnaissance using WHOIS, DNS, and search engines
   • BVulnerability scanning using an automated tool
   • CEnumeration using SMB queries
   • DActive reconnaissance using a port scanner
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After completing a port scan, you discover that a Windows server has SMB (port 445) open. You need to extract a list of valid usernames and shared folders from this service to prepare for a password-spraying test. Which phase and technique does this represent?

   • AExploitation, using Metasploit to gain a shell on the server
   • BScanning, using Nmap to identify the operating system version
   • CVulnerability analysis, using a CVE database to find SMB exploits
   • DEnumeration, using tools like enum4linux or SMB client commands to query the service
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the main objective of vulnerability analysis in ethical hacking?

   • ATo identify weaknesses in systems and networks that could be exploited
   • BTo gather publicly available information about the target
   • CTo actively exploit vulnerabilities to gain access
   • DTo map the target's network topology and identify live hosts
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which action is characteristic of the exploitation phase?

   • AAssessing the severity of vulnerabilities using CVSS scores
   • BEnumerating user accounts on the target
   • CUsing a known exploit to take advantage of a vulnerability and gain access
   • DScanning the target to identify open ports
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security consultant is performing an initial assessment for a client. The consultant wants to gather information about the client's employees and technology stack without sending any packets to the client's network. Which activity best fits this requirement?

   • ASearching public job postings, social media profiles, and the client's website for employee names and technology mentions
   • BUsing a vulnerability scanner to check for known CVEs on the client's web server
   • CSending phishing emails to employees to test their security awareness
   • DRunning a port scan against the client's public IP range to identify open services
   Reveal Solution Discussion Select an answer first