Hacking Concepts and Hacker Classes EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security researcher discovers a critical vulnerability in a widely used web server software. The researcher wants to disclose the vulnerability responsibly. Which action best aligns with responsible disclosure?

   • ANotify the software vendor privately and provide a reasonable time to fix the issue before public disclosure.
   • BKeep the vulnerability secret indefinitely to avoid causing panic.
   • CSell the vulnerability details to the highest bidder without notifying the vendor.
   • DPublish the vulnerability details on a public forum immediately to warn users.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the context of information security, which statement best defines hacking?

   • AThe act of stealing sensitive data from a target organization
   • BThe process of identifying and exploiting weaknesses in a system or network
   • CThe unauthorized access to a computer system for personal gain
   • DThe use of social engineering to trick users into revealing passwords
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security professional is asked to test the security of a company's new firewall. The professional has written authorization from the company's CTO and uses a combination of custom scripts and commercial tools to identify weaknesses. The professional provides a detailed report to the CTO. Which hacker class and skill level best describe this professional?

   • ABlack hat; hacktivist
   • BWhite hat; elite
   • CWhite hat; hacktivist
   • DGray hat; script kiddie
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is hired to test a company's network. The contract specifies that the tester must not use social engineering. During the test, the tester discovers that an employee's password is 'Password123' and that the same password is used for the company's VPN. The tester believes that using this password to access the VPN would be a valid test of the company's security. What should the tester do?

   • AUse the password to access the VPN because it is a valid security test.
   • BAsk the employee for permission to use their password.
   • CUse the password to access the VPN but only to check if it works, then report it.
   • DReport the weak password as a finding without using it to access the VPN.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is hired to assess a company's security posture. The contract requires the tester to report all findings directly to the CISO and to not share any information with third parties. During the test, the tester finds a critical vulnerability that could affect other companies using the same software. The tester is tempted to warn other companies but decides to follow the contract. Which ethical hacking principle is the tester primarily demonstrating?

   • AAuthorization
   • BResponsible disclosure
   • CNon-disclosure
   • DScope adherence
   Reveal Solution Discussion Select an answer first