Ethical Hacking Phases (reconnaissance to Exploitation) ECSS Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   During a penetration test, you have gained initial access to a web server via a vulnerable plugin. Your objective is to access sensitive data stored on an internal database server. The web server is in a DMZ, and the database is on an internal network. Which approach is most appropriate to achieve the objective?

   • AUse the web server as a pivot point to scan and access the internal database
   • BDirectly scan the internal database from your external position
   • CExploit the database server directly from the internet
   • DStop the test and report that the objective is impossible
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   You are leading a penetration test for a client with a strict change-freeze window. The client requires that you identify exploitable vulnerabilities but forbids any action that could disrupt production services. You have completed scanning and enumeration and found a critical vulnerability in a legacy application. What is the best course of action to confirm exploitability without violating the constraint?

   • ARun the exploit against production to prove impact, but only during off-peak hours
   • BSet up a non-production replica of the application and test the exploit there
   • CUse a vulnerability scanner's built-in exploit verification feature on production
   • DReport the vulnerability as confirmed based on the scan results alone
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security consultant is performing reconnaissance for a client. The client has strict rules of engagement that prohibit any active interaction with the target systems until a specific date. However, the consultant needs to gather as much information as possible before that date. Which technique should the consultant use?

   • AVulnerability scanning using an automated tool
   • BEnumeration using SMB queries
   • CPassive reconnaissance using public sources and third-party services
   • DActive reconnaissance using a port scanner
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   You are performing reconnaissance for a client that is highly concerned about detection. The client's security team has advanced IDS/IPS and monitors network traffic aggressively. You need to gather as much information as possible about the client's external attack surface. Which strategy best balances information gathering with the need to avoid detection?

   • AUse only passive techniques and avoid active scanning entirely
   • BUse aggressive active scanning to quickly map the entire attack surface
   • CUse active scanning from multiple distributed source IPs to evade detection
   • DUse passive techniques first, then use low-and-slow active scans only if necessary
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are performing footprinting for a client and need to identify the technologies used on their website, such as web server software and content management system. Which technique is most appropriate?

   • APerforming a brute-force attack on the admin login
   • BExamining HTTP response headers and page source code
   • CUsing a packet sniffer to capture traffic to the website
   • DRunning a vulnerability scanner against the website
   Reveal Solution Discussion Select an answer first