Ethical Hacking Scope, Methodologies, and Frameworks EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company hires an ethical hacker to test the security of its public-facing web application. The contract specifies that testing is limited to the application's production environment during a two-week window. During the engagement, the tester discovers a critical vulnerability in a third-party API that the application uses, but that API is hosted by a different organization. What is the most appropriate action for the tester to take?

   • AStop testing the API and document the potential issue in the report as an observation for the client to follow up on.
   • BContinue testing the API because the vulnerability affects the client's application and is therefore in scope.
   • CImmediately notify the third-party API provider and offer to test their system under a separate agreement.
   • DTest the third-party API to confirm the vulnerability, then include the findings in the final report.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is planning a social engineering assessment for a client. The client wants to test employee awareness but is concerned about legal issues. What should the tester include in the planning phase to ensure the assessment is legally and ethically sound?

   • AAn agreement to test only during business hours
   • BA guarantee that no employee will be harmed
   • CA list of employee names and personal phone numbers
   • DA signed consent form from the client and clear rules of engagement
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration testing team is using the PTES framework. They have completed the vulnerability analysis phase and have identified several exploitable vulnerabilities. The team must now decide which vulnerabilities to exploit first, considering the client's request to minimize impact on production systems. What should the team do?

   • AExploit all vulnerabilities simultaneously to save time.
   • BSkip exploitation and only report the vulnerabilities.
   • CExploit the most critical vulnerabilities first, regardless of potential impact.
   • DPrioritize vulnerabilities that are least likely to cause disruption, and exploit them one at a time.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An ethical hacker is hired to test a company's network. The contract specifies that testing should be limited to non-production systems. During the test, the hacker accidentally gains access to a production database. What should the hacker do immediately?

   • AReport the finding in the final report without mentioning the scope violation.
   • BStop testing, document the incident, and inform the client immediately.
   • CDelete all logs to hide the accidental access.
   • DContinue testing the production database because it is a valuable finding.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In a typical ethical hacking methodology, which phase comes immediately after information gathering?

   • AScanning and enumeration
   • BReporting
   • CGaining access
   • DMaintaining access
   Reveal Solution Discussion Select an answer first