Worksheetsethical
Total questions: 100
Worksheet time: 50mins
Multiple Choice (Single Answer): What is the primary goal of ethical hacking?
To exploit systems for personal gain
To identify vulnerabilities with permission to improve security
To disrupt normal business operations
To train employees in hacking techniques
Multiple Choice (Single Answer): Which of the following is a core principle of ethical hacking?
Full disclosure to the public
Obtaining explicit permission before testing
Keeping findings confidential indefinitely
Testing without scope limitations
Multiple Choice (Single Answer): The CIA Triad stands for:
Confidentiality, Integrity, Authenticity
Confidentiality, Integrity, Availability
Confidentiality, Inspection, Authentication
Control, Integrity, Availability
Multiple Choice (Single Answer): Which phase of the attack lifecycle involves gathering information about the target?
Scanning
Gaining Access
Reconnaissance
Covering Tracks
Multiple Choice (Single Answer): The Principle of Least Privilege means:
Granting users maximum access for efficiency
Granting only the minimum access necessary
Removing all access controls for simplicity
Allowing unlimited access during testing
Multiple Choice (Single Answer): Which framework is specifically designed for web application security testing?
NIST CSF
PTES
OSSTMM
OWASP
Multiple Choice (Single Answer): A MAC address is used at which OSI layer?
Network Layer
Transport Layer
Data Link Layer
Physical Layer
Multiple Choice (Single Answer): What does the IP address 127.0.0.1 refer to?
Public IP
Broadcast address
Loopback address
Default gateway
Multiple Choice (Multiple Answers): Which of the following are phases of the penetration testing lifecycle? (Select all that apply)
Reconnaissance
Reporting
Scanning
Post-Exploitation
Multiple Choice (Multiple Answers): Which of the following are differences between penetration testing and red teaming? (Select all that apply)
Penetration testing is always automated
Red teaming mimics real-world APT attacks
Penetration testing focuses on specific systems
Red teaming does not require permission
Multiple Choice (Multiple Answers): Which of the following are layers of the OSI model? (Select all that apply)
Session Layer
Security Layer
Presentation Layer
Routing Layer
Multiple Choice (Multiple Answers): Which IP address types are used for internal networks? (Select all that apply)
Public IP
Private IP
APIPA
Broadcast IP
True or False: Ethical hacking requires explicit authorization from the organization being tested.
True
False
True or False: Defense in Depth relies on a single security control to protect systems.
True
False
True or False: TCP is a connectionless protocol.
True
False
True or False: IPv6 was introduced primarily to provide more IP addresses than IPv4.
True
False
True or False: Red teaming only focuses on technical vulnerabilities, not people or processes.
True
False
True or False: The OWASP Top 10 is a list of the most critical web application security risks.
True
False
Multiple Choice (Multiple Answers): Explain the key differences between penetration testing and red teaming, including when each should be used in a real-world security assessment. Select all statements that are correct.
Penetration testing is a focused, scope-limited assessment to find technical flaws
Red teaming is a holistic, adversarial simulation testing people, processes, and defenses
Use penetration testing for specific systems
Use red teaming to assess the overall security posture
Multiple Choice (Multiple Answers): Describe the importance of following a structured methodology (e.g., OWASP, PTES, NIST) in penetration testing. Select all statements that are correct.
It ensures consistent, thorough testing
It provides clear reporting
It reduces vulnerability oversight
It produces standardized, actionable results for stakeholders
Multiple Choice (Single Answer): In Linux, which directory contains system configuration files?
/home
/var
/etc
/bin
Multiple Choice (Single Answer): What does the command chmod 755 script.sh do in Linux?
Gives full permissions to everyone
Gives read, write, execute to owner; read and execute to group and others
Gives read and execute only to the owner
Removes all permissions from the file
Multiple Choice (Single Answer): Which Windows command-line tool is used to view IP configuration?
netstat
ping
ipconfig
tracert
Multiple Choice (Single Answer): What is the primary purpose of reconnaissance in ethical hacking?
To exploit vulnerabilities
To gather information about the target
To cover tracks after an attack
To maintain access to a system
Which tool is commonly used for passive reconnaissance?
Nmap
Nessus
Shodan
SQLmap
What does the STAT column value "Z" indicate in the Linux ps aux output?
Running process
Sleeping process
Zombie process
Stopped process
Which Windows command is used to run a command as another user?
sudo
runas
chown
taskkill
What type of scanning involves directly interacting with a target's systems?
Passive reconnaissance
Active reconnaissance
Social engineering
Vulnerability exploitation
Which of the following are Linux commands for file and directory management? Select all that apply.
ls
dir
mkdir
del
Which of the following are tools used for vulnerability scanning? Select all that apply.
Nmap
Nessus
Nikto
theHarvester
Which of the following are key differences between passive and active reconnaissance? Select all that apply.
Passive reconnaissance is more detectable
Active reconnaissance involves direct interaction
Passive reconnaissance uses public sources
Active reconnaissance is slower and less intrusive
Which of the following are standard locations in the Windows file system? Select all that apply.
C:\Windows\System32
/etc
C:\Program Files\
/home
In Linux, the /tmp directory is used for temporary files that are preserved after a reboot.
True
False
The sudo command in Linux allows a user to execute commands with root privileges.
True
False
Windows uses the same permission model (rwx) as Linux for file access control.
True
False
Vulnerability scanners like Nessus can produce false positives that require manual validation.
True
False
CVE (Common Vulnerabilities and Exposures) provides severity scores for vulnerabilities.
True
False
SQLmap is a tool used for web application vulnerability scanning and SQL injection testing.
True
False
Which statement best describes the difference between passive and active reconnaissance and correctly pairs one example tool for each?
Passive reconnaissance gathers information using public sources (e.g., Shodan); active reconnaissance interacts directly with the target (e.g., Nmap)
Passive reconnaissance interacts directly with the target (e.g., Nmap); active reconnaissance uses only public sources (e.g., Shodan)
Passive reconnaissance requires exploitation (e.g., SQLmap); active reconnaissance avoids any network interaction (e.g., theHarvester)
Passive reconnaissance uses credentialed scans (e.g., Nessus); active reconnaissance is limited to OSINT (e.g., Nikto)
Why is understanding both Linux and Windows operating systems important for cybersecurity professionals?
Because Linux is used only on personal laptops and Windows only on servers
Because both are widely used in enterprise environments and knowledge of both is essential for effective attack and defense
Because Windows is used exclusively for security tools while Linux is used only for endpoints
Because learning two operating systems reduces the need for security tools
What is the primary goal of the exploitation phase in penetration testing?
To gather information about the target
To use identified vulnerabilities to gain unauthorized access
To clear logs and cover tracks
To write the final penetration testing report
Which of the following is a common vulnerability associated with SMB (port 445)?
SQL Injection
EternalBlue (MS17-010)
Open SMTP relay
Default SNMP community strings
What is the difference between vertical and horizontal privilege escalation?
Vertical: moving from user to root; Horizontal: accessing another user at same level
Vertical: accessing another user; Horizontal: gaining root access
Both refer to the same concept
Vertical is for Windows; Horizontal is for Linux
Which Linux command shows allowed sudo commands for the current user?
id
sudo -l
uname -a
ls -la /etc/sudoers
What does the Windows command whoami /priv display?
Current user's groups
Installed patches
Current user's privileges
Running processes
Which tool is commonly used for automated privilege escalation enumeration on Windows?
LinPEAS
WinPEAS
GTFOBins
BloodHound
What is a common method for maintaining persistence on a Linux system?
Modifying registry run keys
Creating malicious scheduled tasks
Adding a cron job
DLL hijacking
Which technique involves using stolen NTLM hashes to authenticate without knowing the plaintext password?
Kerberoasting
Pass-the-Hash
RDP hijacking
DLL hijacking
Which of the following are examples of post-exploitation activities? Select all that apply.
Maintaining access via persistence mechanisms
Lateral movement to additional hosts
Exfiltrating sensitive data
Installing vendor patches during the assessment
Which tools are used for privilege escalation on Linux systems? (Select all that apply)
LinPEAS
Mimikatz
LinEnum
PowerUp.ps1
What are common Windows privilege escalation vectors? (Select all that apply)
Unquoted service paths
SUID binaries
AlwaysInstallElevated registry keys
Kernel exploits like MS16-032
Which of the following are lateral movement techniques? (Select all that apply)
Pass-the-Hash
Kerberoasting
SQL Injection
RDP exploitation
Post-exploitation activities only include maintaining access and do not involve data exfiltration.
True
False
The EternalBlue exploit targets a vulnerability in the SMB protocol on Windows systems.
True
False
In Linux, SUID binaries always pose a security risk and should be removed.
True
False
Mimikatz can be used to dump credentials from the LSASS process in Windows.
True
False
Clearing event logs is considered a post-exploitation covering tracks activity.
True
False
Horizontal privilege escalation involves gaining higher-level privileges, such as moving from a user to an administrator.
True
False
Explain the key steps an attacker might take after initial exploitation to maintain access and move laterally within a network.
Establish persistence, escalate privileges, harvest credentials, and move laterally using techniques such as Pass-the-Hash
Immediately exfiltrate all data and disconnect from the network
Focus solely on privilege escalation without credential harvesting or lateral movement
Create decoy files and rely on signature-based detection to avoid discovery
Why is privilege escalation a critical phase in both attack and defense scenarios?
It enables deeper attacker control while requiring defenders to understand and harden systems against these techniques
It primarily serves to delete logs and evidence
It is only relevant for data exfiltration and has limited defensive implications
It replaces the need for persistence and lateral movement
What is the primary goal of maintaining access during post-exploitation?
To delete all evidence of the attack
To ensure continued, undetected control of the system
To escalate privileges to the highest level
To exfiltrate all sensitive data immediately
Which technique involves moving from one compromised machine to others within a network?
Privilege escalation
Lateral movement
Covering tracks
Backdoor installation
What is a common method attackers use to maintain persistence on Windows systems?
Adding cron jobs
Modifying the /etc/passwd file
Creating scheduled tasks
Installing SUID binaries
In the APT28 case study, how did attackers initially gain access to the German Bundestag?
SQL injection
EternalBlue exploit
Spear-phishing emails
Physical intrusion
What does "covering tracks" refer to in the post-exploitation phase?
Installing additional backdoors
Erasing or hiding evidence of compromise
Harvesting credentials
Moving laterally across the network
Which tool is specifically mentioned for detecting persistence methods on Windows?
LinPEAS
BloodHound
PersistenceSniper
CrackMapExec
In the SolarWinds attack, what was the primary vector for distributing the malicious backdoor?
Phishing emails to employees
Compromised software updates
Exploiting unpatched SMB vulnerabilities
Physical access to data centers
What is a key defensive lesson from the SolarWinds incident regarding software supply chains?
Rely on signature-based detection only
Ignore third-party software risks
Implement Software Bill of Materials (SBOM)
Disable all encrypted traffic
Which of the following are common lateral movement techniques? (Select all that apply)
Pass-the-Hash
Kerberoasting
DLL hijacking
RDP hijacking
Which tools are mentioned for maintaining access and command & control (C2)? (Select all that apply)
Cobalt Strike
Metasploit
Mimikatz
Wireshark
What techniques did APT28 use for covering tracks? (Select all that apply)
Clearing event logs
Using encrypted tunnels (X-Tunnel)
Timestamp manipulation
Disabling all security tools
Which of the following are key lessons learned from the SolarWinds attack? (Select all that apply)
Supply chain risk cannot be ignored
Zero Trust and Least Privilege are critical
Behavioral detection is unnecessary
Transparency and information sharing are vital
Maintaining access is only important for attackers and has no relevance for defenders.
True
False
APT28 used X-Agent malware to steal keystrokes and credentials in the German Bundestag attack.
True
False
In the SolarWinds attack, the malicious backdoor (Sunburst) activated immediately upon installation.
True
False
Covering tracks includes actions like deleting logs and modifying file timestamps.
True
False
Spear-phishing was not a factor in the SolarWinds supply chain attack.
True
False
One lesson from APT28 is that multi-layered defense (Defense in Depth) is unnecessary.
True
False
Explain why maintaining access and covering tracks are critical for advanced persistent threat (APT) groups.
They allow APT groups to remain inside a target long term and avoid detection for stealthy operation.
They primarily speed up data exfiltration by increasing bandwidth.
They help attackers deploy ransomware faster on endpoints only.
They reduce the need for command-and-control infrastructure by eliminating network traffic.
Based on the SolarWinds case study, which strategies should organizations adopt to defend against sophisticated supply chain attacks? Select all that apply.
Implement a Zero Trust architecture to limit trust assumptions.
Require Software Bills of Materials (SBOMs) from vendors to increase transparency and vet third‑party software risks.
Increase default administrative privileges for faster incident response.
Disable code signing to simplify deployments.
What is the primary function of a Domain Controller (DC) in Active Directory?
To serve as a web server for the domain
To store the AD database and handle authentication
To act as a firewall for the network
To manage email services for users
Which authentication protocol is the primary one used in Active Directory?
NTLM
LDAP
Kerberos
SAML
What is the purpose of a Service Principal Name (SPN)?
To uniquely identify a user account in the domain
To link a service to a service account for Kerberos authentication
To define the password policy for a domain
To manage Group Policy Objects (GPOs)
What does the NTDS.dit file contain?
Windows system logs
Group Policy settings
Active Directory database including user accounts and password hashes
Network routing tables
In a transitive trust, if Domain A trusts Domain B and Domain B trusts Domain C, what is the relationship between Domain A and Domain C?
Domain A trusts Domain C
Domain C trusts Domain A
There is no trust relationship
The trust is one-way only
Which of the following is a common attack against Kerberos?
DNS spoofing
Kerberoasting
SQL injection
Cross-site scripting (XSS)
What is the main purpose of Group Policy Objects (GPOs)?
To manage hardware devices on the network
To centrally manage settings for users and computers
To create user accounts automatically
To encrypt network traffic
Which Active Directory service provides Single Sign-On (SSO) across multiple systems?
AD DS (Domain Services)
AD LDS (Lightweight Directory Services)
AD FS (Federation Services)
AD RMS (Rights Management Services)
Which of the following are components of Active Directory's logical structure? Select all that apply.
Domains
Trees
Forests
Switches
Which of the following are weaknesses or attack vectors related to NTLM authentication? Select all that apply.
Pass-the-Hash
Relay attacks
Kerberoasting
SMB signing
What are common steps in an Active Directory attack path? Select all that apply.
Enumeration
Credential harvesting
Lateral movement
Domain dominance
Which of the following are types of Active Directory trusts? Select all that apply.
One-way trust
Transitive trust
Forest trust
Universal trust
A workgroup is a centralized network model suitable for large enterprises.
True
False
Kerberos uses Ticket-Granting Tickets (TGTs) and Service Tickets (TGS) for authentication.
True
False
The SID S-1-5-512 corresponds to the Domain Admins group.
True
False
Group Policy Preferences (GPP) passwords are stored in plain text and are a known security weakness.
True
False
AD LDS (Lightweight Directory Services) requires a domain controller to function.
True
False
Compromising the AD CS (Certificate Services) server can lead to certificate-based attacks like Pass-the-PTC.
True
False
Explain why Active Directory is a major target for attackers in enterprise networks.
It centralizes authentication and authorization, so compromising it grants access to domain resources, user credentials, and enables lateral movement.
It is mainly used for hosting public websites, making web defacement the primary risk.
It functions only as a file server for small workgroups, limiting potential impact.
It stores temporary logs that attackers cannot use for privilege escalation.
Describe two common attack techniques against Kerberos in Active Directory and their impact. Select all that apply.
Kerberoasting extracts service account tickets for offline cracking, enabling impersonation.
Golden Ticket attacks forge Ticket-Granting Tickets using the KRBTGT hash, granting unrestricted domain access.
Pass-the-Hash attacks rely on NTLM credential reuse, unrelated to Kerberos tickets.
SQL injection compromises directory databases via application-layer input flaws.
