Ethical Hacking: Penetration Testing Methodology Final quiz

Final Quiz: Ethical Hacking and Penetration Testing Methodology

Pass mark: 75%. You can retry as many times as you need.

1 What is the single most important element that makes a penetration test legal? Single answer Using only open-source tools A written authorisation with a clearly defined scope Having several years of experience in the field

2 In France, which articles of the Penal Code punish fraudulent access to an automated data processing system? Single answer Articles 1240 to 1242 of the Civil Code The GDPR alone, with no Penal Code involvement Articles 323-1 to 323-3-1

3 Which of the following belong in a solid scope document? (several answers) Multiple answers possible A list of systems explicitly out of scope Dates and hours during which testing is authorised Emergency contacts for both the client and the tester A guarantee that no disruption can ever occur

4 A client wants to know exactly what an anonymous internet user could discover about their organisation. Which type of test fits best? Single answer White box Black box Grey box with full source code access

5 What best describes OSINT in the context of a penetration test? Single answer Sending exploit code against a target's public web server Guessing passwords on a public login page Collecting and analysing information that is already publicly available

6 Which of these subdomain discovery techniques are passive, generating no traffic towards the target? (several answers) Multiple answers possible Searching certificate transparency logs for a domain Reviewing subdomains already indexed by search engines Attempting a DNS zone transfer against the target's name server Running a dictionary-based subdomain brute force against the target

7 What does a SYN scan do differently from a full TCP connect scan? Single answer It completes the handshake fully before closing the connection It sends only the first part of the handshake and infers the result from the reply It can only scan UDP ports

8 Why should a version number read from a service banner never be reported as a confirmed fact without further checks? Single answer Because a banner can be outdated, altered, hidden, or belong to a decoy service Because Nmap cannot detect service versions at all Because banners are always encrypted and therefore unreadable

9 What does a CVE identifier represent? Single answer A unique identifier for one specific, publicly known weakness A private attacker-only catalogue of exploits A tool that automatically patches vulnerable software

10 Which limitations do automated vulnerability scanners typically have? (several answers) Multiple answers possible They can produce false positives based on imprecise version matching They generally cannot detect business logic flaws reliably They always run without generating any load on the target They perfectly understand the business context of every client

11 Which factors should be combined when prioritising targets before exploitation? Single answer Only the raw CVSS score of each candidate finding Severity, exposure, business value and confidence of the hypothesis, combined Only how recently the candidate CVE was published

12 What is the main purpose of an exploitation framework such as Metasploit? Single answer To standardise exploit modules, payloads and related tools into a repeatable workflow To automatically generate a client's written authorisation To replace the need for manual verification of findings

13 Why are reverse shells more commonly usable in practice than bind shells? Single answer Because outgoing connections are usually less restricted by firewalls than incoming ones Because reverse shells require no network connection at all Because bind shells are illegal to use even in an authorised lab

14 A tester discovers, through a compromised machine, that an internal system not listed in the scope document appears reachable. What is the correct next step? Single answer Test it immediately since it was found incidentally during an authorised engagement Document the observation and confirm with the client before testing it further Ignore it completely and never mention it to anyone

15 What problem does salting specifically solve in password storage? Single answer It makes precomputed-table attacks impractical by making each user's hash unique It encrypts passwords so the server can decrypt them when needed It prevents users from ever reusing an old password

16 Why is a pass-the-hash issue not fixed simply by requiring very long, random passwords? (several answers) Multiple answers possible Pass-the-hash reuses a derived value directly, without needing to guess the original password The vulnerability depends on protocol and system design, not password complexity Long random passwords make password guessing attacks easier, not harder Pass-the-hash only affects systems that store no passwords at all

17 Which categories commonly explain privilege escalation opportunities on Linux and Windows systems? (several answers) Multiple answers possible Misconfigured permissions on files or scripts run with elevated privileges Outdated system software containing a known, unpatched weakness Exposed credentials in a readable configuration file or script The mere presence of a password-protected login screen

18 What should a professional report always state clearly regarding any persistence mechanism considered during a standard penetration test? Single answer Whether a persistence mechanism was actually deployed or only assessed as theoretically possible The exact commercial price of every tool used during the engagement A guarantee that persistence could never be achieved on the system

19 Why do many experienced testers consider report writing their most important skill? Single answer Because a poorly explained finding, however technically impressive, is likely to be ignored Because clients never read the executive summary of a report Because reports must legally be longer than the technical work itself

20 During an authorised test, you find clear evidence that an unrelated, real attacker already has active unauthorised access to the system. What is the correct immediate action? Single answer Continue testing as planned, since the scope already authorises activity on this system Stop testing that area, document the observation, and escalate immediately to the client contact Attempt to remove the other party's access yourself before continuing