Certified Ethical Hacker Ethical Hacker Methodology 2 — Questions and Answers
Question 1: An ethical hacker reviews a target company's job postings, employee LinkedIn profiles, and DNS records without sending any packets to the target. Which phase and technique is this?
- Active scanning
- Passive reconnaissance (Correct answer)
- Gaining access
- Covering tracks
Correct answer: Passive reconnaissance
Gathering information from public sources without directly interacting with the target is passive reconnaissance.
Question 2: Which document is signed before an engagement begins to define what systems may be tested and the boundaries of the test?
- Rules of Engagement (Correct answer)
- Incident response plan
- Disaster recovery plan
- Acceptable use policy
Correct answer: Rules of Engagement
The Rules of Engagement defines scope, targets, timing, and limitations of the test.
Question 3: During scanning, a tester uses Nmap with the -sS flag. What type of scan is being performed?
- TCP connect scan
- UDP scan
- SYN stealth scan (Correct answer)
- Ping sweep
Correct answer: SYN stealth scan
The -sS flag performs a half-open SYN stealth scan that does not complete the TCP handshake.
Question 4: What is the primary goal of the 'maintaining access' phase of the methodology?
- Identify open ports
- Establish persistent access for return entry (Correct answer)
- Erase log files
- Map the network topology
Correct answer: Establish persistent access for return entry
Maintaining access focuses on creating persistence such as backdoors so the attacker can return.
Question 5: Which phase involves clearing logs and removing tools to avoid detection by defenders?
- Reconnaissance
- Scanning
- Covering tracks (Correct answer)
- Enumeration
Correct answer: Covering tracks
Covering tracks (clearing tracks) removes evidence such as logs and artifacts to evade detection.
Question 6: Enumeration typically follows scanning. What does enumeration extract that scanning does not?
- Live host IP addresses
- Active usernames, shares, and service details (Correct answer)
- Open port numbers
- ICMP echo replies
Correct answer: Active usernames, shares, and service details
Enumeration actively connects to extract detailed info like usernames, shares, and group memberships.
Question 7: A penetration tester wants legal protection clarifying they are authorized to test. Which agreement is most relevant?
- Non-disclosure agreement only
- Get-out-of-jail-free / authorization letter (Correct answer)
- Service level agreement
- Memorandum of understanding for marketing
Correct answer: Get-out-of-jail-free / authorization letter
A signed authorization letter grants explicit legal permission to perform the testing.
Certified Ethical Hacker Ethical Hacker Methodology 2
An ethical hacker reviews a target company's job postings, employee LinkedIn profiles, and DNS records without sending any packets to the target.
Which phase and technique is this?