White Hat Apprentice: From Lab to Professional Report Final quiz

Final Quiz: White Hat Apprentice

Pass mark: 75%. You can retry as many times as you need.

1 In a lab Active Directory forest, a user from a child domain gets very high privileges. Why is this a concern beyond that single domain? Single answer Domains in the same forest are fully isolated, so it is not a concern Because the forest is the real security boundary, high rights in one domain may be a route to the others Because child domains cannot have group policies Because trusts are always one-way

2 A graph of relationships shows a five-step path from an ordinary account to the most powerful group. What is the best use of this information in an authorized engagement? (several answers) Multiple answers possible Describe the chain in plain language with its risk and impact Use it against systems outside the agreed scope to check it is real Recommend removing the relationship that cuts the path with the least business impact Present a diagram that managers can follow, not only a raw screenshot

3 Which set of measures best reduces the risk of Kerberoasting? Single answer Managed service accounts or long random passwords, least privilege and monitoring of service ticket requests Disabling pre-authentication and using shared service passwords Giving service accounts domain administrator rights so they never need help Turning off logging on domain controllers to reduce noise

4 You write a script that prepares a list of lab targets. What is the best design for the scope check? Single answer Accept every address that looks valid and let the client sort it out Skip the check because the written authorization already exists Reject anything not clearly in scope, let exclusions override inclusions and log each reason Delete addresses silently so the report looks clean

5 A log parsing script based on a regular expression matches most lines. Which practices make it more reliable? (several answers) Multiple answers possible Count and inspect the lines that do not match Publish real logs in your portfolio as proof Handle encoding errors so that one strange byte does not stop the script Test the pattern on several different sample lines

6 A header audit script reports that a lab application lacks several security headers. How should this appear in a report? Single answer As critical vulnerabilities leading to full compromise As a factual hygiene observation with an honest severity and a recommendation It should not be reported because headers never matter As proof that the application is secure when all headers are present

7 What distinguishes a red team exercise from a classic penetration test? Single answer A red team does not require written authorization or rules A red team lists every vulnerability in the network There is no difference A red team pursues defined objectives and tests detection and response, rather than listing all weaknesses

8 Which are good practices for a purple team session? (several answers) Multiple answers possible Run the agreed behavior on test machines and observe which logs and alerts appear Test unannounced on production servers to make it realistic Improve the detection and retest the same behavior Keep a no-blame culture and document the results

9 At the start of a supervised exercise, what is the purpose of a stop procedure and emergency contacts? Single answer To let testers continue even when systems become unstable To pause the exercise at once if something goes wrong and reach the right people To hide the exercise from everyone, including the client To replace the written authorization

10 Why is a detection based on a TTP usually more durable than one based on a file hash? Single answer Because hashes cannot be searched in logs Because behavior is harder for an adversary to change than a file's hash Because TTP detections never produce false positives Because a hash is stored only on domain controllers

11 How should a team use the MITRE ATT&CK framework wisely? (several answers) Multiple answers possible As a common language to describe adversary behavior and map detections As proof of compliance as soon as every cell is colored By testing detections and prioritizing techniques relevant to its threats As a list of tools to buy

12 A confirmed incident requires containment. Which approach is best? Single answer Wipe affected machines immediately Change only one account's password and wait Coordinate containment, preserve evidence and keep a log of actions, using a separate communication channel Announce the incident on a public channel to get quick help

13 Which of the following are common cloud misconfigurations? (several answers) Multiple answers possible Storage readable by anyone on the internet by mistake Audit logging of administrative actions sent to a protected location Access keys stored in a source code repository Allow-everything permissions on an application identity

14 An API returns another customer's order when the order number in the request is changed. What is the right fix? Single answer Hide the order number in the mobile application interface Make the application slower so enumeration takes longer Enforce an ownership check on the server for each request Remove HTTPS to simplify debugging

15 What is a sensible way to start adding security scanning to a development pipeline? Single answer Report first, tune, then block only on clear high-severity findings Block every release on any finding immediately Scan only after production incidents Let each developer decide whether to read the results

16 What gives you permission to test a company's website within a bug bounty program? Single answer The site being reachable from the internet Your good intentions The program policy that covers the asset, and staying within its rules A promise to report anything you find

17 Which elements make a vulnerability report credible and actionable? (several answers) Multiple answers possible A specific title and a short summary Unvalidated scanner output with a demand for payment Numbered, reproducible steps and redacted evidence An honest severity rating with a justification and a recommended fix

18 How should you choose your first certification? Single answer Pick the most difficult one, since it impresses everyone Choose by target job, employer requirements, available time and current level, checking official sources Buy leaked exam questions to save time Take the same one as everyone else, whatever your goal

19 Which practices are appropriate when publishing a security portfolio? (several answers) Multiple answers possible Use only lab data or fictional examples Describe an unfixed vulnerability in a real product to show your skill Read each platform's rules before publishing a writeup Check the repository history for committed secrets before publishing

20 Which approach to a 90-day progression plan is most likely to succeed? Single answer Plan twenty hours a week of video watching with no deliverables Set a vague goal such as learning hacking and see what happens Skip rest completely to progress faster One measurable goal, realistic weekly hours, phase milestones with deliverables and weekly reviews