Hacking Concepts and Hacker Classes EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company discovers that a former employee, who was terminated last week, has been using a publicly available exploit script to repeatedly crash the company's public web server. The former employee has no authorization to access the system. How should this individual be classified?

   • AWhite hat hacker
   • BGray hat hacker
   • CHacktivist
   • DBlack hat hacker
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security consultant is hired to perform a red team exercise for a client. The client wants the consultant to test the physical security of their office building. The consultant is given a budget and a timeline. The consultant discovers that the building's front door has a faulty lock that can be easily opened. The consultant also finds an unlocked window on the second floor. Which action is most appropriate?

   • AEnter through the front door, but only after notifying the client of the intention.
   • BReport both vulnerabilities to the client without entering the building.
   • CUse the faulty lock to enter the building and test the internal security.
   • DUse the unlocked window to enter the building because it is less likely to be noticed.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A cybersecurity student, as part of a university course, is given explicit permission by the university to test the campus Wi-Fi network for vulnerabilities. The student uses a known exploit tool to demonstrate a weakness and then provides a report to the IT department. Which hacker class and skill level best describe the student?

   • AWhite hat; script kiddie
   • BWhite hat; elite
   • CGray hat; hacktivist
   • DBlack hat; elite
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A network administrator discovers that an unknown person has been scanning the company's external IP range for open ports. The scans are not authorized, but no data has been stolen and no systems have been damaged. The administrator wants to classify the person's intent. Which classification is most appropriate based on the available information?

   • ABlack hat hacker
   • BElite hacker
   • CGray hat hacker
   • DWhite hat hacker
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester is hired by a retail company to test its e-commerce application. The contract specifies that testing is limited to the application and its backend databases, and explicitly excludes the corporate email system. During testing, the tester discovers that the email system shares the same credentials as the application database. What should the tester do?

   • ATest the email system to confirm the credential reuse, then report it.
   • BChange the email system credentials to prevent further risk.
   • CIgnore the credential reuse because it is out of scope.
   • DReport the credential reuse as an observation without testing the email system.
   Reveal Solution Discussion Select an answer first