Hacking Concepts and Hacker Classes EHE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security consultant is hired by a company to test its defenses. During the engagement, the consultant finds a vulnerability that could be used to access customer data. The consultant also discovers that the company is not compliant with data protection regulations. The consultant has a strict deadline and limited resources. Which action best balances ethical responsibility and professional obligations?

   • AReport only the vulnerability, as the compliance issue is not part of the testing scope
   • BIgnore the compliance issue to avoid scope creep
   • CReport the vulnerability and the compliance issue in the final report
   • DPublicly disclose the compliance issue to regulators
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's security team is analyzing a series of attacks. The first attack used a public exploit kit and targeted known vulnerabilities. The second attack used a custom malware variant that had never been seen before and was designed to evade antivirus. The third attack involved defacing the company's website with a political message. Which classification best describes the attackers in order?

   • AScript kiddie, elite hacker, hacktivist
   • BElite hacker, script kiddie, hacktivist
   • CHacktivist, elite hacker, script kiddie
   • DScript kiddie, hacktivist, elite hacker
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a core principle of ethical hacking?

   • AObtaining explicit authorization from the system owner before testing
   • BTesting systems without a defined scope to uncover all possible issues
   • CUsing the same tools and techniques as malicious hackers to ensure realism
   • DKeeping discovered vulnerabilities secret to avoid alerting attackers
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What primarily motivates a hacktivist?

   • APolitical or social causes
   • BFinancial gain
   • CPersonal challenge
   • DRevenge against a former employer
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is performing an authorized test for a client. During the test, the tester finds a severe vulnerability in a third-party plugin used by the client's website. The tester has no contract with the plugin vendor. What is the most appropriate action?

   • AExploit the vulnerability to prove the impact and then publish the details publicly.
   • BReport the vulnerability to the client and recommend that the client notify the plugin vendor.
   • CContact the plugin vendor directly and demand a fix within 24 hours.
   • DIgnore the vulnerability because it is not part of the client's core systems.
   Reveal Solution Discussion Select an answer first