Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of passive reconnaissance?

   • AUsing a port scanner to identify open ports on the target
   • BBrowsing the target's public website and social media profiles
   • CSending crafted packets to the target to see how it responds
   • DPerforming a vulnerability scan against the target network
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During an authorized penetration test, you need to identify which hosts on a subnet are alive and which TCP ports are open on those hosts. You have been given a list of IP addresses to test. Which tool and technique would most efficiently accomplish this?

   • AUse netstat on your local machine to view active connections
   • BUse Wireshark to capture and analyze all traffic on the subnet
   • CUse Nmap with a ping sweep followed by a TCP connect scan on the specified IP range
   • DUse the ping command to send ICMP echo requests to each IP address
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A penetration tester has identified a critical vulnerability in a web application that allows remote code execution. The tester's goal is to gain initial access to the server to demonstrate the impact. Which phase of the ethical hacking process is the tester about to perform?

   • AVulnerability Analysis
   • BScanning
   • CEnumeration
   • DExploitation
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an authorized penetration test, a tester has completed passive reconnaissance and identified the target's IP range. The next step is to determine which hosts are alive and which ports are open, but the tester must minimize the chance of triggering intrusion detection systems. Which technique should the tester use?

   • ARun a full TCP connect scan on all 65535 ports for every host in the range.
   • BSkip scanning and proceed directly to exploitation using the information gathered from passive reconnaissance.
   • CUse a UDP scan on all ports to avoid TCP-based detection mechanisms.
   • DPerform a ping sweep using ICMP echo requests to identify live hosts, then a SYN scan on common ports.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester is conducting a scan of a target network. The tester wants to identify live hosts, open ports, and the services running on those ports. Which tool or technique is most appropriate for this task?

   • ANmap with SYN scan and service version detection
   • BGoogle search for the target's public IP addresses
   • CWireshark to capture network traffic
   • DNetcat to connect to a known port and banner grab
   Reveal Solution Discussion Select an answer first