CCT CCT Ethical Hacking & Penetration Testing

Question 1

What document legally authorizes a penetration tester to conduct security testing against a target organization?

Accepted Answer

Statement of Authorization (SoA) / Get-Out-of-Jail card

Answer

A written authorization document (often called a Statement of Authorization or 'get-out-of-jail' letter) signed by an authorized executive legally permits the tester to perform activities that would otherwise constitute unauthorized access.

Question 2

Which penetration testing methodology phase involves gathering information about the target without directly interacting with its systems?

Accepted Answer

Passive reconnaissance

Answer

Passive reconnaissance collects information about a target using publicly available sources (OSINT) such as WHOIS, DNS records, and social media without sending any packets to the target.

Question 3

What is the primary purpose of the Metasploit Framework in penetration testing?

Accepted Answer

Develop, test, and execute exploit code against target systems

Answer

Metasploit is an open-source penetration testing framework that provides a library of exploits, payloads, and auxiliary modules to test vulnerabilities in target systems.

Question 4

What distinguishes a 'white-box' penetration test from a 'black-box' test?

Accepted Answer

White-box testers have full knowledge of the target environment, while black-box testers have none

Answer

White-box testing provides the tester with full information (source code, architecture diagrams, credentials), simulating an insider threat, while black-box testing mimics an external attacker with no prior knowledge.

Question 5

Which Nmap scan type is considered a 'stealth scan' because it does not complete the TCP three-way handshake?

Accepted Answer

SYN scan (-sS)

Answer

The SYN scan (half-open scan) sends a SYN packet and analyzes the response without completing the handshake, making it less likely to be logged by many older systems.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT CCT Ethical Hacking & Penetration Testing