ETHICAL HACKING FINAL EXAM – QUESTIONS AND ANSWERS | VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains
Network Security and Protocols
Vulnerability Assessment and Penetration Testing
Cryptography and Public Key Infrastructure (PKI)
Web Application and Database Security
Wireless and Mobile Security
Operating System Security and Hardening
Incident Response and Disaster Recovery
Legal, Regulatory, and Compliance Frameworks
Ethical Hacking Methodologies and Professional Ethics
Introduction
This comprehensive examination is designed to rigorously assess a candidate's knowledge, analytical skills, and
practical decision-making abilities in the field of ethical hacking. The exam covers a wide spectrum of foundational
theories, applied professional knowledge, and critical regulatory and legal compliance standards essential for a
competent cybersecurity professional. Through a combination of multiple-choice questions and scenario-based
problems, candidates will demonstrate their capacity to identify vulnerabilities, implement security controls, and
respond to incidents in real-world environments. The emphasis is on applying ethical principles and professional
standards to solve complex security challenges, ensuring that the successful candidate is prepared to protect
organizational assets and maintain the highest level of professional integrity.
,SECTION ONE: QUESTIONS 1–100
1. Which of the following represents the PRIMARY goal of the reconnaissance phase in a penetration test?
A. To gain unauthorized access to a target system
B. To disrupt the target organization's operations
C. To gather as much information as possible about the target
D. To install backdoors for persistent access
🟢C
🔴 Explanation: The reconnaissance phase is the first step in ethical hacking, focused on passively or actively
gathering information about the target, such as network ranges, domain names, and employee details. The goal is
to build a profile of the target to identify potential entry points, not to disrupt operations or gain immediate
access.
2. Which TCP port is commonly used by the HTTPS protocol for secure web communication?
A. 22
B. 80
C. 443
D. 1433
🟢C
🔴 Explanation: HTTPS uses TCP port 443 by default. Port 22 is used for SSH, port 80 is for HTTP, and port 1433 is
for Microsoft SQL Server. Knowing default port assignments is fundamental for network scanning and identifying
services.
3. What is the primary purpose of a vulnerability scanner like Nessus?
A. To exploit vulnerabilities and gain access to systems
B. To automatically identify and report security weaknesses in a system
C. To provide a firewall for network protection
, D. To manage user authentication and authorization
🟢B
🔴 Explanation: A vulnerability scanner is an automated tool designed to probe systems, networks, and
applications for known vulnerabilities. It reports these weaknesses to the security professional, who then decides
on the appropriate remediation steps. It does not actively exploit vulnerabilities or provide network firewalling.
4. An ethical hacker discovers a critical vulnerability in a client's system during a test. According to the "Rules of
Engagement," what is the MOST appropriate first step?
A. Exploit the vulnerability to demonstrate its severity
B. Immediately inform the client's technical team to begin patching
C. Record the finding in the penetration test report and continue testing
D. Publish the vulnerability to a public security mailing list
🟢B
🔴 Explanation: The primary responsibility in an ethical engagement is to protect the client. Immediately and
responsibly disclosing the vulnerability to the client's technical point-of-contact allows them to take urgent action
to mitigate the risk. Exploitation beyond what is necessary or public disclosure would be unethical and potentially
illegal.
5. Which of the following attacks involves an attacker intercepting and relaying a user's authentication credentials to
impersonate them?
A. A Denial-of-Service (DoS) attack
B. A Pass-the-Hash attack
C. A Man-in-the-Middle (MitM) attack
D. A SQL Injection attack
🟢C
🔴 Explanation: A Man-in-the-Middle (MitM) attack is a general class of attacks where the attacker secretly relays
and possibly alters the communication between two parties. This can be used to steal session tokens or
, credentials to impersonate a user. Pass-the-Hash is a specific credential theft technique, SQL injection targets
databases, and DoS aims for service disruption.
6. What is the role of a "root Certificate Authority" (CA) in a Public Key Infrastructure (PKI)?
A. To issue digital certificates to end-users and servers
B. To verify the identity of a user requesting a certificate
C. To serve as the most trusted and top-level certificate issuer
D. To generate a Certificate Signing Request (CSR) for a website
🟢C
🔴 Explanation: The root CA is the foundation of trust in a PKI. It is a highly trusted entity that issues certificates
to intermediate CAs or directly to end entities. Its public key is pre-installed in browsers and operating systems,
making it the ultimate authority for certificate validation.
7. A system is configured with a firewall rule that permits all incoming traffic on port 80 but blocks all traffic on port
443. Which type of traffic is being allowed?
A. Encrypted web traffic
B. Secure Shell (SSH) traffic
C. Unencrypted web traffic
D. Mail transfer traffic
🟢C
🔴 Explanation: Port 80 is the default port for HTTP, which is unencrypted web traffic. Port 443 is for HTTPS, which
is encrypted. A rule permitting port 80 allows standard, non-secure web browsing.
8. Which of the following is a passive reconnaissance technique?
A. Performing a port scan using Nmap
B. Interrogating public DNS records
C. Sending ping sweeps to a network range
D. Running a vulnerability scan against a web server
🟢B
RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains
Network Security and Protocols
Vulnerability Assessment and Penetration Testing
Cryptography and Public Key Infrastructure (PKI)
Web Application and Database Security
Wireless and Mobile Security
Operating System Security and Hardening
Incident Response and Disaster Recovery
Legal, Regulatory, and Compliance Frameworks
Ethical Hacking Methodologies and Professional Ethics
Introduction
This comprehensive examination is designed to rigorously assess a candidate's knowledge, analytical skills, and
practical decision-making abilities in the field of ethical hacking. The exam covers a wide spectrum of foundational
theories, applied professional knowledge, and critical regulatory and legal compliance standards essential for a
competent cybersecurity professional. Through a combination of multiple-choice questions and scenario-based
problems, candidates will demonstrate their capacity to identify vulnerabilities, implement security controls, and
respond to incidents in real-world environments. The emphasis is on applying ethical principles and professional
standards to solve complex security challenges, ensuring that the successful candidate is prepared to protect
organizational assets and maintain the highest level of professional integrity.
,SECTION ONE: QUESTIONS 1–100
1. Which of the following represents the PRIMARY goal of the reconnaissance phase in a penetration test?
A. To gain unauthorized access to a target system
B. To disrupt the target organization's operations
C. To gather as much information as possible about the target
D. To install backdoors for persistent access
🟢C
🔴 Explanation: The reconnaissance phase is the first step in ethical hacking, focused on passively or actively
gathering information about the target, such as network ranges, domain names, and employee details. The goal is
to build a profile of the target to identify potential entry points, not to disrupt operations or gain immediate
access.
2. Which TCP port is commonly used by the HTTPS protocol for secure web communication?
A. 22
B. 80
C. 443
D. 1433
🟢C
🔴 Explanation: HTTPS uses TCP port 443 by default. Port 22 is used for SSH, port 80 is for HTTP, and port 1433 is
for Microsoft SQL Server. Knowing default port assignments is fundamental for network scanning and identifying
services.
3. What is the primary purpose of a vulnerability scanner like Nessus?
A. To exploit vulnerabilities and gain access to systems
B. To automatically identify and report security weaknesses in a system
C. To provide a firewall for network protection
, D. To manage user authentication and authorization
🟢B
🔴 Explanation: A vulnerability scanner is an automated tool designed to probe systems, networks, and
applications for known vulnerabilities. It reports these weaknesses to the security professional, who then decides
on the appropriate remediation steps. It does not actively exploit vulnerabilities or provide network firewalling.
4. An ethical hacker discovers a critical vulnerability in a client's system during a test. According to the "Rules of
Engagement," what is the MOST appropriate first step?
A. Exploit the vulnerability to demonstrate its severity
B. Immediately inform the client's technical team to begin patching
C. Record the finding in the penetration test report and continue testing
D. Publish the vulnerability to a public security mailing list
🟢B
🔴 Explanation: The primary responsibility in an ethical engagement is to protect the client. Immediately and
responsibly disclosing the vulnerability to the client's technical point-of-contact allows them to take urgent action
to mitigate the risk. Exploitation beyond what is necessary or public disclosure would be unethical and potentially
illegal.
5. Which of the following attacks involves an attacker intercepting and relaying a user's authentication credentials to
impersonate them?
A. A Denial-of-Service (DoS) attack
B. A Pass-the-Hash attack
C. A Man-in-the-Middle (MitM) attack
D. A SQL Injection attack
🟢C
🔴 Explanation: A Man-in-the-Middle (MitM) attack is a general class of attacks where the attacker secretly relays
and possibly alters the communication between two parties. This can be used to steal session tokens or
, credentials to impersonate a user. Pass-the-Hash is a specific credential theft technique, SQL injection targets
databases, and DoS aims for service disruption.
6. What is the role of a "root Certificate Authority" (CA) in a Public Key Infrastructure (PKI)?
A. To issue digital certificates to end-users and servers
B. To verify the identity of a user requesting a certificate
C. To serve as the most trusted and top-level certificate issuer
D. To generate a Certificate Signing Request (CSR) for a website
🟢C
🔴 Explanation: The root CA is the foundation of trust in a PKI. It is a highly trusted entity that issues certificates
to intermediate CAs or directly to end entities. Its public key is pre-installed in browsers and operating systems,
making it the ultimate authority for certificate validation.
7. A system is configured with a firewall rule that permits all incoming traffic on port 80 but blocks all traffic on port
443. Which type of traffic is being allowed?
A. Encrypted web traffic
B. Secure Shell (SSH) traffic
C. Unencrypted web traffic
D. Mail transfer traffic
🟢C
🔴 Explanation: Port 80 is the default port for HTTP, which is unencrypted web traffic. Port 443 is for HTTPS, which
is encrypted. A rule permitting port 80 allows standard, non-secure web browsing.
8. Which of the following is a passive reconnaissance technique?
A. Performing a port scan using Nmap
B. Interrogating public DNS records
C. Sending ping sweeps to a network range
D. Running a vulnerability scan against a web server
🟢B
