A company has a public-facing web server with an unpatched vulnerability. An attacker exploits it to deface the website. What is the threat, and what is the vulnerability?

Threat: unpatched server; Vulnerability: attacker

Threat: defacement; Vulnerability: website

Threat: attacker; Vulnerability: unpatched server

Threat: internet; Vulnerability: firewall

A company's employees frequently fall for phishing emails because they are not trained to recognize them. Which vulnerability category does this represent, and what type of threat exploits it?

Configuration vulnerability; insider threat

Technical vulnerability; malware threat

Human-factor vulnerability; social engineering threat

Physical vulnerability; natural disaster threat

Which of the following is a non-human threat source?

A disgruntled employee who plans to leak confidential data

A hacker who attempts to breach a network for financial gain

A flood that damages a data center's servers

A competitor who conducts industrial espionage

A security analyst is explaining to a non-technical manager why a vulnerability in a legacy system is still a risk even though the system is not connected to the internet. Which explanation is most accurate?

The vulnerability can be exploited by insiders or through other connected systems.

The risk is zero because the system is not internet-facing.

The vulnerability is a configuration issue, so it is not a real risk.

The system is not at risk because it is isolated.

A company's network is infected with ransomware after an employee clicked a malicious link. Which threat source and vulnerability category are involved?

Natural disaster; configuration vulnerability

Malware; physical vulnerability

External hacker; technical vulnerability

EC-CouncilEthical Hacking Essentials

Domain 1Objective 2

Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 4)

Part of the Information Security and Ethical Hacking Foundations domain, which makes up ~16% of our current practice bank.

44questions here

9free pages

6concepts

Questions 16–20

16application · medium
A company has a public-facing web server with an unpatched vulnerability. An attacker exploits it to deface the website. What is the threat, and what is the vulnerability?
Select an answer first
17application · medium
A company's employees frequently fall for phishing emails because they are not trained to recognize them. Which vulnerability category does this represent, and what type of threat exploits it?
Select an answer first
18foundation · easy
Which of the following is a non-human threat source?
Select an answer first
19expert · hard
A security analyst is explaining to a non-technical manager why a vulnerability in a legacy system is still a risk even though the system is not connected to the internet. Which explanation is most accurate?
Select an answer first
20application · medium
A company's network is infected with ransomware after an employee clicked a malicious link. Which threat source and vulnerability category are involved?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.