Cyber Security Ethical Hacking and Penetration Testing 2 — Questions and Answers
Question 1: What is SQL injection?
- Uploading malicious SQL files to a server
- Injecting malicious SQL code into input fields to manipulate database queries (Correct answer)
- Cracking database passwords via brute force
- Sniffing SQL traffic on the network
Correct answer: Injecting malicious SQL code into input fields to manipulate database queries
SQL injection inserts malicious SQL statements into user input fields to manipulate backend database queries.
Question 2: What is cross-site scripting (XSS)?
- Injecting SQL into web forms
- Injecting malicious scripts into web pages viewed by other users (Correct answer)
- Forging cross-domain HTTP requests
- Exploiting server-side script execution
Correct answer: Injecting malicious scripts into web pages viewed by other users
XSS injects malicious client-side scripts into web pages, allowing attackers to steal cookies or redirect users.
Question 3: What does a CVE (Common Vulnerabilities and Exposures) number identify?
- A classification of malware families
- A publicly known cybersecurity vulnerability with a unique identifier (Correct answer)
- A standard for encrypting network traffic
- An authorization level for penetration testers
Correct answer: A publicly known cybersecurity vulnerability with a unique identifier
CVE numbers are unique identifiers assigned to publicly disclosed cybersecurity vulnerabilities.
Question 4: Which Metasploit module type is used to take advantage of a vulnerability to gain access to a target?
- Auxiliary
- Post
- Exploit (Correct answer)
- Encoder
Correct answer: Exploit
Exploit modules in Metasploit contain the code to take advantage of specific vulnerabilities on target systems.
Question 5: What is the purpose of a payload in exploitation?
- Identify open ports on a target
- Execute code on the target after a vulnerability is exploited (Correct answer)
- Encrypt the communication channel
- Generate a vulnerability report
Correct answer: Execute code on the target after a vulnerability is exploited
A payload is code delivered to the target after exploitation to perform actions such as opening a remote shell.
Question 6: What technique does a pentester use to move from one compromised system to other systems on the same network?
- Privilege escalation
- Lateral movement (Correct answer)
- Data exfiltration
- Persistence
Correct answer: Lateral movement
Lateral movement involves using an initial foothold to access other systems within the same network environment.
Cyber Security Ethical Hacking and Penetration Testing 2
What is SQL injection?