Hacking Concepts and Hacker Classes EHE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security consultant is hired by a bank to test its online banking portal. The consultant signs a contract that defines the exact IP ranges and application URLs that may be tested, and the testing is scheduled for off-peak hours. During the test, the consultant discovers a critical vulnerability in a customer-facing API that is outside the defined scope. What is the most appropriate action for the consultant?

   • AAdd the API to the scope without notifying the client and test it thoroughly.
   • BStop testing the API and report the finding to the client as an out-of-scope observation.
   • CContinue testing the API quietly and only mention it if asked.
   • DExploit the API to demonstrate the risk, then include it in the final report.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security consultant is hired to perform a penetration test. The contract includes a clause that allows the consultant to use 'any means necessary' to test the security of the client's network. During the test, the consultant discovers that the client's network is also used by a third-party partner via a VPN. The consultant could easily pivot into the partner's network. The consultant has no authorization from the partner. What is the most appropriate action?

   • APivot into the partner's network but only to verify the vulnerability, then report it.
   • BPivot into the partner's network because the contract allows 'any means necessary'.
   • CPivot into the partner's network and document the findings as a bonus.
   • DStop the test and inform the client of the risk, asking for guidance on how to proceed.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What distinguishes a gray hat hacker from a white hat hacker?

   • AGray hat hackers lack malicious intent but may operate without authorization
   • BGray hat hackers always have written permission
   • CGray hat hackers always have malicious intent
   • DGray hat hackers are less skilled than white hat hackers
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A company discovers that a former employee, who was a skilled security engineer, has been accessing the company's network without authorization. The former employee is using a custom backdoor that they created while employed. The employee's motive appears to be revenge for being fired. Which classification best describes the former employee?

   • AScript kiddie with hacktivist motives
   • BGray hat hacker with non-malicious intent
   • CWhite hat hacker performing ethical hacking
   • DBlack hat hacker with elite skill
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company hires a penetration tester to evaluate its new web application. The tester is given a test account with limited privileges. During the test, the tester discovers that the application has a privilege escalation vulnerability that could allow full admin access. The tester's contract states that the goal is to 'identify vulnerabilities that could lead to unauthorized access.' The tester successfully escalates privileges and gains admin access. What should the tester do next?

   • AUse the admin access to test all features and document the full impact.
   • BStop the escalation test and report the vulnerability with proof of concept.
   • CKeep the admin access and continue testing other systems.
   • DDelete all user data to prove the severity of the vulnerability.
   Reveal Solution Discussion Select an answer first