Question 1

What name is given to people who break into computer systems with the sole purpose to steal or destroy data?
A) packet monkeys
B) crackers
C) script kiddies
D) bots

Accepted Answer

The term "crackers" is commonly used to refer to people who break into computer systems with the intent to steal or destroy data. This is different from the term "hackers," which generally refers to people who explore computer systems to improve their functionality and security. The other options, packet monkeys, script kiddies, and bots, are also involved in computer security but do not specifically refer to individuals who engage in unauthorized access to computer systems.

Question 2

Why is it a challenge and concern for an ethical hacker to avoid breaking any laws?

Accepted Answer

The answer of Why is it a challenge and concern...

Question 3

In the context of penetration testing,what is the gray box model?

Accepted Answer

The answer of In the context of penetration testing,what is...

Question 4

What organization disseminates research documents on computer and network security worldwide at no cost?
A) EC-Council
B) SANS
C) ISECOM
D) ISC2

Accepted Answer

SANS (SysAdmin, Audit, Network, and Security) Institute is known for providing a wealth of research documents, training, and security certifications to professionals worldwide, often at no cost, especially through their reading room and various community-driven initiatives.

Question 5

What common term is used by security testing professionals to describe vulnerabilities in a network?
A) bytes
B) packets
C) bots
D) holes

Accepted Answer

"Holes" is a common term used by security testing professionals to describe vulnerabilities in a network. Bytes and packets are not necessarily associated with vulnerabilities, and while bots can be used to exploit vulnerabilities, they are not typically considered a term used to describe vulnerabilities themselves.

Question 6

What is the SANS Institutes "Top 25 Software Errors" list?

Accepted Answer

The answer of What is the SANS Institutes "Top 25...

Question 7

What are four different skills a security tester needs to be successful?

Accepted Answer

The answer of What are four different skills a security...

Question 8

If you work for a company as a security professional,you will most likely be placed on a special team that will conduct penetration tests.What is the standard name for a team made up of security professionals?
A) pen team
B) blue team
C) red team
D) security team

Accepted Answer

The standard name for a team made up of security professionals that conducts penetration tests is a red team. The term "red team" comes from military and intelligence organizations, where it refers to a group of experts who simulate an attack by an adversary to identify weaknesses in security measures. In the cybersecurity industry, a red team is responsible for conducting simulated attacks on an organization's network, systems, and applications to identify vulnerabilities and recommend improvements.

Question 9

What type of assessment performed by a penetration tester attempts to identify all the weaknesses found in an application or on a system?
A) health
B) technical
C) vulnerability
D) network

Accepted Answer

A vulnerability assessment is performed by a penetration tester to identify all the weaknesses found in an application or on a system. Health assessments evaluate the overall performance and availability of systems, technical assessments evaluate the technical setup of a system, and network assessments evaluate the security of a network.

Question 10

What professional security certification requires applicants to demonstrate hands-on abilities to earn their certificate?
A) Offensive Security Certified Professional
B) Certified Ethical Hacker
C) Certified Information Systems Security Professional
D) CompTIA Security+

Accepted Answer

Offensive Security Certified Professional (OSCP) requires applicants to demonstrate hands-on abilities through a 24-hour exam where they must hack into five different machines using only their skills and creativity. This hands-on approach sets OSCP apart from other certifications like Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP) which primarily test knowledge through written exams. CompTIA Security+ also tests both knowledge and skills but does not have a hands-on component as extensive as OSCP.

Question 11

Penetration testing can create ethical,technical,and privacy concerns for a company's management team.What can a security consultant do to ensure the client fully understands the scope of testing that will be performed?
A) create a contractual agreement
B) create a lab demonstration
C) create a virtual demonstration
D) create a slide presentation

Accepted Answer

The best choice would be to create a contractual agreement that clearly defines the scope and limitations of the penetration testing. This agreement should outline the testing procedures, type of data that will be accessed, timeframe for testing, and any legal or liability concerns. By having a written agreement, both the security consultant and the client will have a clear understanding of the expectations and limitations of the testing process, which can help mitigate any ethical, technical, or privacy concerns. A lab or virtual demonstration may also be helpful to show the client what the testing process will involve, but it is not enough on its own to ensure the client fully understands the scope of testing that will be performed. A slide presentation may also be useful, but again, it is not sufficient to ensure the client's understanding and agreement.

Question 12

When a security professional is presented with a contract drawn up by a company's legal department,which allows them to "hack" the company's network,they should proceed by performing what precautionary step?
A) consult the company's lawyer
B) consult their lawyer
C) sign the contract
D) begin testing immediately

Accepted Answer

Consulting their own lawyer is the best precautionary step for the security professional to take before signing any contract. This will ensure that they fully understand the legal implications and potential risks of performing the "hack" and that their actions are within the bounds of the law.

Question 13

Why are employees sometimes not told that the company's computer systems are being monitored?

Accepted Answer

The answer of Why are employees sometimes not told that...

Question 14

A Security professional may think they are following the requirements set forth by the client who hired them to perform a security test,don't assume that management will be happy with the test results.Provide an example of an ethical hacking situation that might upset a manager.

Accepted Answer

The answer of A Security professional may think they are...

Question 15

List at least five domains tested for the Certified Ethical Hacker (CEH)exam.

Accepted Answer

The answer of List at least five domains tested for...

Question 16

Describe some actions which security testers cannot perform legally.

Accepted Answer

The answer of Describe some actions which security testers cannot...

Question 17

Why are ethical hackers employed or contracted by a company to conduct vulnerability assessments,penetration tests,and security tests?

Accepted Answer

The answer of Why are ethical hackers employed or contracted...

Question 18

What professional level security certification requires five years of experience and is designed to focus on an applicant's security-related managerial skills?
A) Certified Information Systems Security Professional
B) Offensive Security Certified Professional
C) OSSTMM Professional Security Tester
D) Certified Ethical Hacker

Accepted Answer

The Certified Information Systems Security Professional (CISSP) requires five years of experience and focuses on an applicant's security-related managerial skills. The other options, Offensive Security Certified Professional (OSCP), OSSTMM Professional Security Tester, and Certified Ethical Hacker (CEH), are technical certifications focused on penetration testing and ethical hacking skills.

Question 19

Why should a security professional or student learning hacking techniques be aware of the local,state,and federal laws that apply to their field of study?

Accepted Answer

The answer of Why should a security professional or student...

Question 20

What federal law makes it illegal to intercept any type of communication,regardless of how it was transmitted?
A) Fraud and Abuse Act
B) Interception Abuse Act
C) Electronic Communication Privacy Act
D) The Computer Fraud Act

Accepted Answer

The Electronic Communication Privacy Act (ECPA) makes it illegal to intercept any type of communication, regardless of how it was transmitted. The ECPA is a federal law that was enacted in 1986 and amended in 2001. It applies to electronic communications, including emails, text messages, and cell phone calls. The law provides protection for the privacy of communication and prohibits interception of electronic communication without the consent of the parties involved.

Quiz 1: Ethical Hacking Overview

What name is given to people who break into computer systems with the sole purpose to steal or destroy data?

Why is it a challenge and concern for an ethical hacker to avoid breaking any laws?

In the context of penetration testing,what is the gray box model?

What organization disseminates research documents on computer and network security worldwide at no cost?

What common term is used by security testing professionals to describe vulnerabilities in a network?

What is the SANS Institutes "Top 25 Software Errors" list?

What are four different skills a security tester needs to be successful?

If you work for a company as a security professional,you will most likely be placed on a special team that will conduct penetration tests.What is the standard name for a team made up of security professionals?

What type of assessment performed by a penetration tester attempts to identify all the weaknesses found in an application or on a system?

What professional security certification requires applicants to demonstrate hands-on abilities to earn their certificate?

Penetration testing can create ethical,technical,and privacy concerns for a company's management team.What can a security consultant do to ensure the client fully understands the scope of testing that will be performed?

When a security professional is presented with a contract drawn up by a company's legal department,which allows them to "hack" the company's network,they should proceed by performing what precautionary step?