Hacking Concepts and Hacker Classes EHE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security researcher discovers a vulnerability in a popular software product. The researcher is not authorized to test the product, but they found the vulnerability by accident while using the software. The researcher wants to disclose the vulnerability to the vendor. What is the most appropriate action?

   • AIgnore the vulnerability because the researcher was not authorized to test.
   • BSell the vulnerability to a third party to recover the cost of the research.
   • CPublish the vulnerability details publicly to force the vendor to fix it.
   • DNotify the vendor privately and provide a reasonable time to fix the issue.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a routine security review, a company finds that a group of attackers has been defacing the company website with political messages. The attackers used a widely available content management system exploit and did not attempt to steal data. Which classification best fits this group?

   • AScript kiddies
   • BHacktivists
   • CWhite hat hackers
   • DElite hackers
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security researcher discovers a zero-day vulnerability in a widely used web server. The researcher is not affiliated with the vendor and has no authorization to test the affected systems. The researcher wants to improve security but also wants to avoid legal repercussions. Which action best balances ethical responsibility and legal risk?

   • APublish the vulnerability on a public forum immediately to force a quick fix
   • BPrivately notify the vendor and provide a reasonable time to fix before any disclosure
   • CSell the vulnerability to a government agency for profit
   • DExploit the vulnerability on a public server to prove the risk
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company hires an ethical hacker to test its internal network. The contract includes a clause that any discovered vulnerabilities must be reported only to the company's security team and not disclosed publicly. During testing, the hacker finds a critical vulnerability in a third-party component. The hacker reports it to the company, but the company decides not to fix it immediately. The hacker then publishes the vulnerability details on a public forum to pressure the company. Which ethical principle did the hacker violate?

   • AAuthorization
   • BNon-repudiation
   • CScope adherence
   • DResponsible disclosure
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security researcher finds a vulnerability in a popular open-source project. The researcher is not affiliated with the project. The researcher also discovers that the vulnerability is being actively exploited in the wild. The researcher wants to disclose the vulnerability responsibly. What is the best course of action?

   • ASell the vulnerability to a government agency for a bounty.
   • BKeep the vulnerability secret to avoid helping the attackers.
   • CPublish the vulnerability immediately to warn the public, since it is being exploited.
   • DNotify the project maintainers and provide a short deadline for a fix, then publish if no fix is released.
   Reveal Solution Discussion Select an answer first