Ethical Hacking: Penetration Testing Methodology Quiz

Quiz: Exploitation

Pass mark: 70%. You can retry as many times as you need.

1 What is the main purpose of an exploitation framework such as Metasploit? Single answer To standardise exploit modules, payloads and related tools into a repeatable workflow To automatically write a final report for the client To replace the need for a written authorisation and scope

2 Which steps belong in a disciplined exploitation workflow? (several answers) Multiple answers possible Confirming the target is explicitly within the authorised scope before acting Choosing the least disruptive payload that still proves the point Launching many different exploit attempts in parallel to save time Recording the exact time, target, method and result immediately after an attempt

3 Why are reverse shells more commonly usable in practice than bind shells? Single answer Because reverse shells do not require any network connection at all Because outgoing connections are usually less restricted by firewalls than incoming ones Because bind shells are illegal to use even in an authorised lab

4 After obtaining what appears to be command execution on a target, what should a tester do before anything else? Single answer Immediately attempt privilege escalation and lateral movement Delete the evidence of the attempt to keep the target clean Verify the access with safe, read-only commands before deciding on further steps

5 A tester discovers, through a compromised machine, that an internal system not listed in the scope document appears reachable. What is the correct next step? Single answer Test it immediately, since it was found incidentally during an authorised engagement Document the observation and confirm with the client before testing it further Ignore it completely and never mention it in the report