Understanding Ethical Hacking Concepts

In a company, a team of ethical hackers is hired to assess the security of their systems. What is the significance of methodological ethical hacking in this context?

• It is primarily used for marketing purposes.

• It systematically identifies vulnerabilities and strengthens security.

• It only focuses on compliance with regulations.

• It guarantees complete security against all threats.

Adi is preparing a preliminary document for a penetration testing project. What are the key components he should include in this document?

• Compliance regulations, customer demographics, market analysis

• Scope, objectives, rules of engagement, target systems, timelines, resource requirements.

• User feedback, product features, sales targets

• Budget constraints, team structure, marketing strategy

Heri is tasked with conducting a penetration test for a new client. As part of his preparation, he needs to describe the process of information gathering in penetration testing.

• Data encryption techniques

• The process of information gathering in penetration testing includes reconnaissance, scanning, enumeration, OSINT, and analysis.

• Network configuration management

• Malware analysis procedures

During a cybersecurity assessment, a team of experts is tasked with identifying vulnerabilities in a company's network. They need to choose the right tools for vulnerability scanning to ensure the security of the system.

• Nessus, OpenVAS, Qualys, Burp Suite

• Metasploit

• Wireshark

• Snort

How do social engineering attacks manipulate individuals?

• Through the use of malware to directly control devices.

• Social engineering attacks manipulate individuals by exploiting psychological principles and emotional responses.

• By offering financial incentives to individuals for sensitive information.

• By using advanced hacking techniques to gain access to systems.

During a company meeting, Maya shares a story about how she received an email that looked like it was from her bank, asking her to verify her account information. She explains how this is a common tactic used by attackers to trick individuals into giving away personal information. What are some common techniques used in social engineering?

• Phishing, pretexting, baiting, tailgating

• DDoS attacks

• Spoofing

• Malware distribution

Arif is tasked with ensuring the security of his company's wired network. He needs to identify any vulnerabilities that could be exploited by attackers.

• Identify wired network vulnerabilities by mapping devices, scanning for open ports, assessing configurations, analyzing traffic, performing vulnerability assessments, and reviewing physical security.

• Relying solely on antivirus software

• Using only wireless connections

• Ignoring physical security measures

Dewi is setting up a wireless network for her new café. She is aware of the potential risks associated with wireless network vulnerabilities. What are the risks she should be concerned about?

• Increased battery life

• Improved signal strength

• Risks include unauthorized access, data interception, network attacks, and data breaches.

• Enhanced encryption methods

Indah, a software developer, discovers that her application has a vulnerability that allows users to manipulate inputs. How can application-based vulnerabilities be exploited?

• By changing the application's color scheme

• Exploiting application-based vulnerabilities involves manipulating inputs or exploiting flaws in the application logic to execute unauthorized actions.

• By increasing the application's processing speed

• Through unauthorized access to the server's hardware

During a recent security audit at a tech company, the security team discovered several vulnerabilities in their web applications. They found that the applications were susceptible to various attacks. What are the common types of application vulnerabilities that the team should be aware of?

• SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Insecure Direct Object References (IDOR), Security Misconfiguration, Sensitive Data Exposure, Broken Authentication, and Insufficient Logging and Monitoring.

• Malware Injection

• Denial of Service (DoS)

• Buffer Overflow