Certified Ethical Hacker Vulnerability Assessment and Exploitation

Question 1

What is the difference between a vulnerability assessment and a penetration test?

Accepted Answer

A vulnerability assessment identifies weaknesses; a pen test actively exploits them

Answer

A vulnerability assessment identifies and reports security weaknesses without exploiting them, while a penetration test actively exploits vulnerabilities to demonstrate real-world impact.

Question 2

Which CVSS metric indicates how easily an attacker can repeat a successful exploit?

Accepted Answer

Attack Complexity

Answer

Attack Complexity (AC) in CVSS measures the conditions beyond the attacker's control required to exploit the vulnerability, indicating how reliably the exploit can be repeated.

Question 3

Which tool is an industry-standard open-source vulnerability scanner used in CEH assessments?

Accepted Answer

OpenVAS

Answer

OpenVAS (Greenbone Vulnerability Manager) is a widely used open-source vulnerability scanner that checks systems against thousands of known vulnerability tests.

Question 4

What type of vulnerability assessment is performed without any prior knowledge of the target environment?

Accepted Answer

Black Box Assessment

Answer

A black box assessment simulates an external attacker with no prior knowledge, testing the target purely from an outsider's perspective.

Question 5

Which Metasploit component stores information about discovered hosts, services, and vulnerabilities during an engagement?

Accepted Answer

The Metasploit Database (msfdb)

Answer

The Metasploit database (msfdb), backed by PostgreSQL, stores all workspace data including discovered hosts, open ports, services, and vulnerability findings.

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Vulnerability Assessment and Exploitation