Hacking Concepts and Hacker Classes EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A regional bank hires a security consultant to test its new online banking portal. The consultant signs a contract that explicitly limits testing to the portal's login and transaction modules during off-peak hours, and the bank provides a dedicated test account. During the engagement, the consultant discovers a critical SQL injection flaw in a legacy internal tool that is out of scope. The consultant does not exploit the flaw further and reports it to the bank's CISO. Which hacker class and ethical principle does this scenario best illustrate?

   • AWhite hat hacker; scope adherence and responsible disclosure
   • BGray hat hacker; responsible disclosure
   • CElite hacker; full disclosure
   • DBlack hat hacker; authorization
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What does 'responsible disclosure' mean in the context of ethical hacking?

   • AReporting a vulnerability to the affected vendor and giving them time to fix it before public release
   • BPublishing vulnerability details immediately to warn other users
   • CKeeping vulnerability details secret indefinitely
   • DSelling vulnerability information to the highest bidder
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is hired to test a company's web application. The contract specifies that the tester must not cause any disruption to the production environment. During the test, the tester finds a vulnerability that, if exploited, could crash the application server. The tester wants to prove the vulnerability is real. What is the most appropriate action?

   • AExploit the vulnerability to prove it, then report it.
   • BAsk the client for permission to exploit the vulnerability, then do it.
   • CExploit the vulnerability during off-peak hours to minimize impact.
   • DReport the vulnerability without exploiting it, explaining the potential impact.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A company's security team is profiling an attacker who defaced the company's website and left a political message. The attacker used a custom script that exploited a known vulnerability, but the script was poorly written and caused errors. The attacker did not attempt to hide their IP address. Which classification best describes the attacker?

   • AWhite hat hacker performing authorized testing
   • BGray hat hacker with ethical intent
   • CScript kiddie with hacktivist motives
   • DElite hacker with hacktivist motives
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A company's security team is analyzing a recent breach. The attacker used a custom tool that exploited a previously unknown vulnerability, and the attack specifically targeted the company's proprietary algorithms. The attacker left no traces and the attack was discovered only after a third party reported suspicious activity. Which classification best describes the attacker?

   • AWhite hat hacker performing authorized testing
   • BElite hacker with a targeted objective
   • CScript kiddie with hacktivist motives
   • DGray hat hacker with ethical intent
   Reveal Solution Discussion Select an answer first