CCT CCT Ethical Hacking & Penetration Testing 2 — Questions and Answers
Question 1: What is the goal of the 'post-exploitation' phase in a penetration test?
- Scanning for open ports and services
- Maintaining access, pivoting, and demonstrating the impact of a compromise (Correct answer)
- Documenting findings in the final report
- Obtaining initial access to the target
Correct answer: Maintaining access, pivoting, and demonstrating the impact of a compromise
Post-exploitation demonstrates the real-world impact of a compromise by pivoting to other systems, escalating privileges, and exfiltrating data to show what an attacker could achieve.
Question 2: Which tool is commonly used for password cracking by performing dictionary and brute-force attacks against password hashes?
- Wireshark
- John the Ripper (Correct answer)
- Nessus
- Burp Suite
Correct answer: John the Ripper
John the Ripper is a popular open-source password security auditing tool that can crack password hashes using dictionary attacks, brute-force attacks, and rule-based attacks.
Question 3: What is a 'pivot' in penetration testing?
- Changing the scope of the engagement mid-test
- Using a compromised system as a relay to attack other internal systems not directly accessible (Correct answer)
- Switching from active to passive reconnaissance
- Escalating privileges on a single compromised host
Correct answer: Using a compromised system as a relay to attack other internal systems not directly accessible
Pivoting uses a compromised host as a jump point to reach and attack other network segments or systems that are not directly reachable from the attacker's machine.
Question 4: What is the OWASP Testing Guide primarily used for?
- Configuring firewalls and IDS systems
- Providing a comprehensive methodology for web application security testing (Correct answer)
- Managing vulnerability disclosure programs
- Automating network penetration tests
Correct answer: Providing a comprehensive methodology for web application security testing
The OWASP Testing Guide provides a structured framework with test cases for identifying security vulnerabilities in web applications, covering authentication, authorization, input validation, and more.
Question 5: Which type of social engineering attack involves creating a fabricated scenario to manipulate a target into divulging information?
- Phishing
- Pretexting (Correct answer)
- Tailgating
- Baiting
Correct answer: Pretexting
Pretexting involves constructing a fabricated scenario (a pretext) to extract information or gain trust from a target, such as impersonating IT support to get a user's password.
Question 6: What does a vulnerability scanner like Nessus do that a port scanner like Nmap does not?
- Identify open ports and running services
- Actively exploit discovered vulnerabilities
- Test vulnerabilities and misconfigurations against known CVE databases and provide risk ratings (Correct answer)
- Capture network traffic for analysis
Correct answer: Test vulnerabilities and misconfigurations against known CVE databases and provide risk ratings
Vulnerability scanners go beyond port scanning by probing detected services for known vulnerabilities, misconfigurations, and missing patches, then correlating findings with CVE databases and assigning severity scores.
CCT CCT Ethical Hacking & Penetration Testing 2
What is the goal of the 'post-exploitation' phase in a penetration test?