Ethical Hacking Scope, Methodologies, and Frameworks EHE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An ethical hacker is conducting a test for a client that has multiple business units. The contract covers the entire organization, but the client's legal team has specified that testing must not involve any form of social engineering due to privacy concerns. During the test, the hacker identifies a severe vulnerability in a business unit's application that could be exploited via a phishing attack. What is the most appropriate course of action?

   • AIgnore the vulnerability because it is in a different business unit.
   • BAsk the business unit manager for permission to conduct the phishing test.
   • CExploit the vulnerability using a phishing email to demonstrate the risk.
   • DReport the vulnerability and recommend that the business unit conduct its own social engineering test under a separate agreement.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is preparing for a red team exercise. They need a framework that helps them model the tactics, techniques, and procedures (TTPs) of real adversaries to plan their attack simulations. Which framework is most appropriate?

   • APTES
   • BISO/IEC 27005
   • CMITRE ATT&CK
   • DOWASP Testing Guide
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester is planning an engagement and needs to define the phases from initial agreement to final reporting. The tester wants a structured approach that includes a formal rules-of-engagement document, reconnaissance, vulnerability analysis, exploitation, and post-exploitation. Which methodology best fits this requirement?

   • AOSSTMM (Open Source Security Testing Methodology Manual)
   • BISO/IEC 27001
   • COWASP Testing Guide
   • DPTES (Penetration Testing Execution Standard)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is planning an engagement for a client. The client wants to know which systems will be tested and what techniques will be used. The tester needs to produce a document that outlines the testing boundaries, the rules of engagement, and the expected deliverables. Which step of the ethical hacking methodology does this activity represent?

   • AReconnaissance
   • BReporting
   • CScanning
   • DPlanning and authorization
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester is engaged to test a company's internal network. The contract allows testing of all internal IP addresses but explicitly prohibits social engineering. During the engagement, the tester finds an employee's password written on a sticky note and uses it to access a server. Which statement is correct?

   • AThe tester violated the scope because using the password is a form of social engineering.
   • BThe tester acted within scope because the server is on the internal network and the password was not obtained through social engineering.
   • CThe tester must stop the engagement and report the password to the client immediately.
   • DThe tester should only use the password if the client is informed first.
   Reveal Solution Discussion Select an answer first