Ethical Hacking Scope, Methodologies, and Frameworks EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company hires a penetration testing firm to assess its external web application. The contract specifies a two-week window, the IP ranges to test, and a list of approved test credentials. During the engagement, the tester discovers a critical vulnerability in a third-party payment API that is not in the approved scope. The tester decides to exploit it to prove impact. Which action violates the ethical hacking scope?

   • AUsing the approved test credentials to access the web application
   • BReporting the discovered vulnerability in the final report
   • CExploiting the third-party payment API without authorization
   • DStopping the test after the two-week window ends
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is documenting the steps taken during a penetration test. The analyst notes that the team used a framework that emphasizes the importance of pre-engagement interactions, including defining scope and rules of engagement. Which framework is the analyst likely referring to?

   • ANIST SP 800-115
   • BISO 27001
   • COWASP Testing Guide
   • DPTES
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is tasked with evaluating the organization's security posture against known adversary behaviors. The analyst wants to map existing security controls to specific attack techniques to identify gaps. Which framework is best suited for this task?

   • APTES
   • BISO/IEC 27002
   • COWASP Testing Guide
   • DMITRE ATT&CK
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is conducting an internal assessment. The tester has completed the reconnaissance phase and is now identifying vulnerabilities in the target systems. According to common penetration testing methodologies, what is the next logical phase?

   • AReporting
   • BCleanup
   • CPost-exploitation
   • DExploitation
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of the OSSTMM (Open Source Security Testing Methodology Manual) framework?

   • ATo define legal penalties for unauthorized hacking
   • BTo offer a set of tools for automated vulnerability scanning
   • CTo provide a list of common vulnerabilities and exposures
   • DTo provide a standardized methodology for security testing and analysis
   Reveal Solution Discussion Select an answer first