CSL Ethical Hacking & Incident Response 2 — Questions and Answers
Question 1: Under the Computer Fraud and Abuse Act (CFAA), what distinguishes authorized penetration testing from criminal hacking?
- The tools used during the test
- Written permission from the system owner (Correct answer)
- The time of day the test is conducted
- Whether vulnerabilities are actually exploited
Correct answer: Written permission from the system owner
Written authorization from the system owner is the critical legal distinction that makes penetration testing lawful under the CFAA.
Question 2: A penetration tester discovers a zero-day vulnerability during an engagement but it falls outside the agreed scope. What is the legally appropriate action?
- Exploit it to demonstrate impact, then report
- Ignore it since it is out of scope
- Immediately notify the client and document the finding without exploiting it (Correct answer)
- Report it anonymously to a vulnerability database
Correct answer: Immediately notify the client and document the finding without exploiting it
Responsible disclosure requires notifying the client about out-of-scope critical findings without exploitation to stay within legal and ethical boundaries.
Question 3: Which legal doctrine allows incident responders to access third-party systems without a warrant when the system owner provides consent?
- Plain view doctrine
- Third-party consent doctrine (Correct answer)
- Exigent circumstances exception
- Good faith exception
Correct answer: Third-party consent doctrine
The third-party consent doctrine allows consent from an authorized system owner or administrator to permit lawful access by incident responders.
Question 4: An ethical hacker finds credentials for a client's partner company during a test. What should the tester do?
- Use the credentials to test the partner's systems for additional vulnerabilities
- Report the credentials to the client and stop any further use immediately (Correct answer)
- Delete the credentials and continue the engagement
- Notify the partner company directly without telling the client
Correct answer: Report the credentials to the client and stop any further use immediately
Discovered third-party credentials must be reported to the client immediately without being used, as testing the partner's systems would exceed authorized scope.
Question 5: Which incident response phase involves identifying the root cause and attack vector of a security breach?
- Containment
- Eradication
- Analysis/Identification (Correct answer)
- Recovery
Correct answer: Analysis/Identification
The Analysis/Identification phase focuses on determining what happened, how it happened, and confirming the scope of the incident.
Question 6: Under HIPAA, within how many days must covered entities notify affected individuals of a data breach?
- 30 days
- 45 days
- 60 days (Correct answer)
- 72 hours
Correct answer: 60 days
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach.
Question 7: A Rules of Engagement (ROE) document in a penetration test primarily serves to:
- Outline the technical methodology the tester will use
- Define the legal and operational boundaries protecting both parties (Correct answer)
- Establish the fee structure for the engagement
- Certify that the tester holds required credentials
Correct answer: Define the legal and operational boundaries protecting both parties
The ROE defines scope, permitted activities, timing, and legal protections, forming the contractual and legal framework for the entire engagement.
CSL Ethical Hacking & Incident Response 2
Under the Computer Fraud and Abuse Act (CFAA), what distinguishes authorized penetration testing from criminal hacking?