Ethical Hacking Scope, Methodologies, and Frameworks EHE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is engaged to test a client's cloud infrastructure. The client uses a shared responsibility model and requires that the tester not perform any testing that could affect other tenants. The tester must balance the need for thorough testing with the constraint of not impacting shared resources. Which approach best satisfies both requirements?

   • APerform active scanning of the entire cloud environment to ensure no vulnerabilities are missed.
   • BLimit testing to the client's own virtual networks and resources, using passive techniques where possible.
   • CUse social engineering to gain access to other tenants' data to demonstrate the risk.
   • DTest the cloud provider's physical infrastructure to ensure the underlying security.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is planning to test the security of their organization's web application. They want to use a framework that focuses specifically on web application security and provides a comprehensive testing guide. Which framework should they choose?

   • ANIST Cybersecurity Framework
   • BOWASP Testing Guide
   • CPTES
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is hired to test a company's internal network. The contract explicitly prohibits social engineering attacks. During the test, the tester finds that the company's employees are susceptible to phishing. What is the most appropriate action?

   • AConduct a phishing simulation to prove the vulnerability.
   • BAsk the client for verbal permission to proceed with the phishing test.
   • CIgnore the finding because social engineering is out of scope.
   • DReport the susceptibility as a finding and recommend security awareness training.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following best defines the scope of an ethical hacking engagement?

   • AThe list of vulnerabilities the ethical hacker expects to find in the target environment
   • BThe total budget and timeline allocated for the penetration test
   • CThe set of tools and techniques the ethical hacker plans to use during the engagement
   • DThe specific systems, networks, and applications that the ethical hacker is authorized to test, along with the rules of engagement
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is conducting an external assessment. The client's contract states that the tester must not perform denial-of-service (DoS) tests. During the assessment, the tester accidentally sends a malformed packet that crashes a public-facing server. What should the tester do first?

   • AModify the contract to allow DoS testing retroactively.
   • BRestart the server and continue testing as if nothing happened.
   • CImmediately stop the test and inform the client of the accidental outage.
   • DContinue testing other systems and include the crash in the final report.
   Reveal Solution Discussion Select an answer first