Certified Ethical Hacker Ethical Hacker Methodology 5

Question 1

After gaining a low-privileged shell, a tester exploits a misconfiguration to become root. What is this step called?

Accepted Answer

Privilege escalation

Answer

Privilege escalation raises an attacker's permissions from a low-level account to administrator or root.

Question 2

Which classification describes a hacker who tests systems without permission but discloses flaws to the owner without malicious intent?

Accepted Answer

Gray hat

Answer

A gray hat acts without authorization but generally without malicious intent, reporting issues afterward.

Question 3

A client only wants the tester to assess externally facing web applications. Where is this restriction defined?

Accepted Answer

In the scope of the engagement

Answer

The scope defines exactly which systems and assets are authorized for testing.

Question 4

What is the purpose of obtaining a proof of concept (PoC) during exploitation?

Accepted Answer

To demonstrate that a vulnerability is genuinely exploitable

Answer

A PoC demonstrates that a discovered vulnerability can actually be exploited, validating the risk.

Question 5

Which phase would include using tools like Maltego to map relationships between people, domains, and infrastructure?

Accepted Answer

Reconnaissance

Answer

Maltego is an OSINT tool used during reconnaissance to map relationships among entities.

Certified Ethical Hacker Practice Test