Cyber Security Jobs Penetration Testing and Ethical Hacking 2 — Questions and Answers
Question 1: What is SQL injection and how does a pentester test for it?
- Inserting malicious SQL into input fields to manipulate a database; tested by submitting SQL characters like ' or 1=1-- (Correct answer)
- Injecting malware into SQL Server installation files
- Testing database backup speed
- Auditing SQL query performance
Correct answer: Inserting malicious SQL into input fields to manipulate a database; tested by submitting SQL characters like ' or 1=1--
SQL injection exploits unsanitized input fields to manipulate database queries; pentesters test by entering SQL metacharacters and observing error responses or data leakage.
Question 2: What is privilege escalation in a penetration test?
- Gaining higher-level access (e.g., admin) from a lower-privilege account after initial access (Correct answer)
- Requesting additional permissions through HR
- Upgrading software to the latest version
- Expanding the scope of the penetration test
Correct answer: Gaining higher-level access (e.g., admin) from a lower-privilege account after initial access
Privilege escalation involves exploiting vulnerabilities or misconfigurations to gain higher-level permissions than initially obtained, such as moving from user to administrator.
Question 3: Which Kali Linux tool is used for password cracking using dictionary and brute-force attacks?
- John the Ripper or Hashcat (Correct answer)
- Microsoft Word
- FileZilla
- VirtualBox
Correct answer: John the Ripper or Hashcat
John the Ripper and Hashcat are the leading password cracking tools on Kali Linux, supporting dictionary attacks, brute force, and rule-based attacks against password hashes.
Question 4: What is cross-site scripting (XSS) and why do pentesters look for it?
- Injecting malicious scripts into web pages viewed by other users; exploitable for session hijacking (Correct answer)
- A method of bypassing SSL certificates
- A technique for bypassing firewalls
- A network packet manipulation attack
Correct answer: Injecting malicious scripts into web pages viewed by other users; exploitable for session hijacking
XSS allows attackers to inject client-side scripts into web pages, potentially stealing session cookies, redirecting users, or defacing sites, making it a critical web app finding.
Question 5: What is the purpose of a penetration test report?
- Document findings, severity ratings, evidence, and remediation recommendations for the client (Correct answer)
- Bill the client for testing hours
- Archive exploit code for future use
- Submit vulnerabilities to CVE directly
Correct answer: Document findings, severity ratings, evidence, and remediation recommendations for the client
A pentest report communicates discovered vulnerabilities with evidence, CVSS severity scores, and actionable remediation steps to help the client fix identified weaknesses.
Question 6: What does CVSS stand for and what does it measure?
- Common Vulnerability Scoring System; measures the severity of a vulnerability on a 0-10 scale (Correct answer)
- Certified Vulnerability Security Standard; a certification exam
- Custom Vector Search System; a database query method
- Cyber Vulnerability Surveillance System; a monitoring tool
Correct answer: Common Vulnerability Scoring System; measures the severity of a vulnerability on a 0-10 scale
CVSS (Common Vulnerability Scoring System) provides a standardized 0–10 numerical score reflecting a vulnerability's severity based on exploitability and impact.
Cyber Security Jobs Penetration Testing and Ethical Hacking 2
What is SQL injection and how does a pentester test for it?