Countermeasures Across Hacking Phases EHE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's public website includes a 'team' page that lists employee names, job titles, and email addresses. A security consultant warns that this information could be used for social engineering. Which countermeasure would best reduce this risk?

   • ARemove the team page or restrict access to it with authentication.
   • BUse a web application firewall (WAF) to block requests to the team page.
   • CAdd a CAPTCHA to the team page.
   • DObfuscate the email addresses using JavaScript.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's security team wants to ensure that if an attacker compromises a server, they cannot delete or alter the logs that would reveal their activities. Which countermeasure is the most effective?

   • AStore logs locally in an encrypted folder.
   • BSet the local logs to read-only after they are written.
   • CIncrease the log retention period to 90 days.
   • DSend all logs to a remote syslog server that only accepts append-only writes.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a server that may have been compromised. The analyst notices that the server's system files have been modified, and there is a suspicious process running that was not there before. The analyst suspects a rootkit is hiding the process. Which countermeasure would be the most effective to detect the rootkit?

   • ACheck the server's event logs for any unusual activity.
   • BRun a standard antivirus scan on the server while it is running.
   • CUse the task manager to look for the suspicious process.
   • DBoot the server from a trusted forensic CD and compare the system files against known-good hashes.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is planning to deploy a new customer portal. The portal must be publicly accessible, but the company wants to minimize the risk of reconnaissance and scanning. Which approach best balances accessibility and security?

   • AAllow direct internet access to the application server on all ports.
   • BPlace the portal behind a reverse proxy that only forwards requests to the application server on specific ports.
   • CUse a public IP address for the application server and rely on a host-based firewall.
   • DPut the portal on a separate VLAN with no internet access.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does network segmentation help mitigate scanning and enumeration?

   • ABy providing strong authentication for all users
   • BBy automatically patching vulnerabilities in all systems
   • CBy encrypting all data transmitted between segments
   • DBy limiting the ability of an attacker to scan and enumerate systems across the entire network
   Reveal Solution Discussion Select an answer first