CCNA Intro Ethical Hacking Questions

Ethical hacking requires proving risk without causing harm or exceeding authorization. A non-destructive proof of concept, such as a boolean-based injection test or retrieving only non-sensitive metadata, demonstrates the vulnerability exists while honoring the contract's restriction on patient data. This approach protects patients, preserves the client relationship, and still gives the hospital actionable evidence for remediation.

A useful penetration testing report must let the client act and let auditors verify due diligence. Prioritized findings with evidence show what is wrong and how it was proven, while a clear statement of scope, methodology, and limitations defines what the results do and do not cover. Together they support remediation planning and defensible compliance documentation.

Before active testing, an ethical hacker must operate under explicit written authorization that defines scope, timing, and restrictions. The Rules of Engagement captures those operational constraints, including in-scope IP ranges and forbidden actions such as denial-of-service. Referencing it ensures the consultant stays within legal and contractual boundaries and can demonstrate authorization if questioned during the engagement.

C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

The server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.

In a reverse shell using Netcat, the correct sequence is: first, the attacker sets up a listener on a chosen port; second, the victim executes a command that connects back to the attacker's listener; third, the attacker gains a shell on the victim machine; fourth, the attacker executes commands; and finally, cleanup is performed to close the connection. This order ensures the listener is ready before the victim connects, and that the shell is operational before executing any commands or terminating the session.

Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

The TCP three-way handshake establishes a connection: SYN, SYN-ACK, ACK, then data transfer.

Gray-box testing supplies the tester with partial knowledge, such as a standard user account or network diagrams, which simulates an attacker who has some insider access while cutting down on time-consuming discovery. This matches the client's dual goal: realistic external-style testing and efficient use of the testing window. Full-knowledge and no-knowledge assessments each satisfy only one of those priorities.

The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.