Countermeasures Across Hacking Phases EHE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security consultant is reviewing the defenses of a mid-sized company. The company has a public website that leaks server version information, a flat network with no segmentation, and no centralized logging. The company's budget is limited, and they need to prioritize countermeasures across the hacking phases. Which countermeasure should be implemented FIRST to provide the most immediate reduction in risk across multiple phases?

   • AImplement network segmentation to isolate the public-facing servers from internal systems.
   • BDeploy a centralized logging solution.
   • CRemove version information from the public website.
   • DInstall endpoint protection on all servers.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers that an attacker has installed a backdoor on a Linux server that re-establishes a reverse shell every time the server reboots. The analyst needs to remove the persistence mechanism and prevent reinfection. Which action should be taken first?

   • ADisconnect the server from the network and reimage it.
   • BRun a full antivirus scan on the server.
   • CDelete the backdoor binary and kill the associated process.
   • DInspect startup scripts, cron jobs, and systemd services for suspicious entries and remove them.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which measure is most effective in detecting log tampering?

   • ADisabling logging to reduce the attack surface
   • BStoring logs only on the local system
   • CUsing cryptographic hashes to verify log integrity
   • DUsing simple text files for logs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to reduce the amount of information an external attacker can gather during the reconnaissance phase. They currently publish employee names, email addresses, and phone numbers on their public website, and they have a firewall that blocks all inbound traffic except web and email. Which additional countermeasure would most effectively reduce the effectiveness of passive reconnaissance?

   • AAdd an intrusion detection system (IDS) to monitor inbound traffic for scanning patterns.
   • BConfigure the firewall to block all outbound traffic except web and email.
   • CRemove employee contact details from the public website and publish only a generic contact form.
   • DImplement network segmentation to isolate the public web server from internal systems.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's marketing team publishes a weekly newsletter with a link to a public-facing file share that lists employee names, email addresses, and phone numbers. A security assessment reveals that attackers are using this information to craft targeted phishing emails. Which countermeasure would most directly reduce the effectiveness of this reconnaissance technique?

   • ADisable directory listing on the web server hosting the file share.
   • BRestrict access to the file share with authentication and remove the public link.
   • CAdd an intrusion detection system (IDS) to monitor the file share traffic.
   • DImplement a web application firewall (WAF) in front of the file share.
   Reveal Solution Discussion Select an answer first