CCT CCT Ethical Hacking & Penetration Testing 1 — Questions and Answers
Question 1: What document legally authorizes a penetration tester to conduct security testing against a target organization?
- Non-Disclosure Agreement (NDA)
- Rules of Engagement (RoE) / Scope of Work
- Statement of Authorization (SoA) / Get-Out-of-Jail card (Correct answer)
- Service Level Agreement (SLA)
Correct answer: Statement of Authorization (SoA) / Get-Out-of-Jail card
A written authorization document (often called a Statement of Authorization or 'get-out-of-jail' letter) signed by an authorized executive legally permits the tester to perform activities that would otherwise constitute unauthorized access.
Question 2: Which penetration testing methodology phase involves gathering information about the target without directly interacting with its systems?
- Active reconnaissance
- Exploitation
- Passive reconnaissance (Correct answer)
- Post-exploitation
Correct answer: Passive reconnaissance
Passive reconnaissance collects information about a target using publicly available sources (OSINT) such as WHOIS, DNS records, and social media without sending any packets to the target.
Question 3: What is the primary purpose of the Metasploit Framework in penetration testing?
- Perform passive DNS reconnaissance
- Develop, test, and execute exploit code against target systems (Correct answer)
- Capture and analyze network packets
- Scan for open wireless access points
Correct answer: Develop, test, and execute exploit code against target systems
Metasploit is an open-source penetration testing framework that provides a library of exploits, payloads, and auxiliary modules to test vulnerabilities in target systems.
Question 4: What distinguishes a 'white-box' penetration test from a 'black-box' test?
- White-box tests are only performed on web applications
- White-box testers have full knowledge of the target environment, while black-box testers have none (Correct answer)
- Black-box tests are more thorough than white-box tests
- White-box tests are performed by internal staff only
Correct answer: White-box testers have full knowledge of the target environment, while black-box testers have none
White-box testing provides the tester with full information (source code, architecture diagrams, credentials), simulating an insider threat, while black-box testing mimics an external attacker with no prior knowledge.
Question 5: Which Nmap scan type is considered a 'stealth scan' because it does not complete the TCP three-way handshake?
- TCP Connect scan (-sT)
- UDP scan (-sU)
- SYN scan (-sS) (Correct answer)
- FIN scan (-sF)
Correct answer: SYN scan (-sS)
The SYN scan (half-open scan) sends a SYN packet and analyzes the response without completing the handshake, making it less likely to be logged by many older systems.
Question 6: What is privilege escalation in the context of a penetration test?
- Gaining initial access to a target system
- Increasing access rights from a lower-privileged account to a higher-privileged one (Correct answer)
- Exfiltrating data from a compromised host
- Covering tracks after completing a test
Correct answer: Increasing access rights from a lower-privileged account to a higher-privileged one
Privilege escalation involves exploiting vulnerabilities or misconfigurations to gain higher-level permissions (e.g., moving from a standard user account to administrator or root).
CCT CCT Ethical Hacking & Penetration Testing 1
What document legally authorizes a penetration tester to conduct security testing against a target organization?