©EMILLECT 2024/2025 ACADEMIC YEAR. ALL RIGHTS RESERVED
FIRST PUBLISH OCTOBER 2024
IT 430 – Midterm Exam Study Guide
Solutions
Explain the differences between the types of hackers - ANSWER✔✔1. White Hat: computer security
specialist who breaks into protected systems and networks to test and asses their security
2. Grey Hat: middle ground between bad and good, someone who may violate ethical standards or
principles, but without the malicious intent
3. Black Hat: person who attempts to find computer security vulnerabilities and exploit them for
personal financial gain or other malicious reasons
Define what constitutes penetration testing - ANSWER✔✔Having the authorization to compromise the
network of a company
Discuss the differing test types and what they evaluate - ANSWER✔✔White Box: testing method in which
the internal structure/ design/ implementation of the item being tested is known to the tester.
Page 1/16
, ©EMILLECT 2024/2025 ACADEMIC YEAR. ALL RIGHTS RESERVED
FIRST PUBLISH OCTOBER 2024
Grey Box: tester has limited knowledge of internet details of the system
Black Box: testing method in which the internal structure/ design/ implementation of the item being
tested is NOT known to the tester
Analyze the criteria involved in coordinating a penetration test
Discuss the importance of protecting the test report - ANSWER✔✔1. Pre-engagement: scope, contract
negotiation
2. Information Gathering: begin test by gathering publically available data
3. Threat Modeling: attack planning stage
4. Vulnerability Analysis: run scanners to find weaknesses
Page 2/16
, ©EMILLECT 2024/2025 ACADEMIC YEAR. ALL RIGHTS RESERVED
FIRST PUBLISH OCTOBER 2024
5. Exploitation: run exploits against vulnerabilities
6. Post Exploitation: (optional)
gather further information form successful exploits
7. Reporting: report findings, must protect because report contains all vulnerabilities hackers can use
Explain why exceeding the scope of a penetration test might cause problems - ANSWER✔✔Must stay
within the legal limits of pen test or else you will be breaking the law
Discuss some of the possible effects of a pen test that the company should be made aware of -
ANSWER✔✔Unintended consequences, denial of service
Discuss the two categories of laws that might apply to pen testing - ANSWER✔✔Laws pertaining to
punishment of cyber crime (hacking)
Regulatory laws that produce need for ethical hacking
Analyze the impact of the U.S. Code of Fair Information Practices on modern database systems -
ANSWER✔✔no personal record keeping system whose existence is secret
Page 3/16
FIRST PUBLISH OCTOBER 2024
IT 430 – Midterm Exam Study Guide
Solutions
Explain the differences between the types of hackers - ANSWER✔✔1. White Hat: computer security
specialist who breaks into protected systems and networks to test and asses their security
2. Grey Hat: middle ground between bad and good, someone who may violate ethical standards or
principles, but without the malicious intent
3. Black Hat: person who attempts to find computer security vulnerabilities and exploit them for
personal financial gain or other malicious reasons
Define what constitutes penetration testing - ANSWER✔✔Having the authorization to compromise the
network of a company
Discuss the differing test types and what they evaluate - ANSWER✔✔White Box: testing method in which
the internal structure/ design/ implementation of the item being tested is known to the tester.
Page 1/16
, ©EMILLECT 2024/2025 ACADEMIC YEAR. ALL RIGHTS RESERVED
FIRST PUBLISH OCTOBER 2024
Grey Box: tester has limited knowledge of internet details of the system
Black Box: testing method in which the internal structure/ design/ implementation of the item being
tested is NOT known to the tester
Analyze the criteria involved in coordinating a penetration test
Discuss the importance of protecting the test report - ANSWER✔✔1. Pre-engagement: scope, contract
negotiation
2. Information Gathering: begin test by gathering publically available data
3. Threat Modeling: attack planning stage
4. Vulnerability Analysis: run scanners to find weaknesses
Page 2/16
, ©EMILLECT 2024/2025 ACADEMIC YEAR. ALL RIGHTS RESERVED
FIRST PUBLISH OCTOBER 2024
5. Exploitation: run exploits against vulnerabilities
6. Post Exploitation: (optional)
gather further information form successful exploits
7. Reporting: report findings, must protect because report contains all vulnerabilities hackers can use
Explain why exceeding the scope of a penetration test might cause problems - ANSWER✔✔Must stay
within the legal limits of pen test or else you will be breaking the law
Discuss some of the possible effects of a pen test that the company should be made aware of -
ANSWER✔✔Unintended consequences, denial of service
Discuss the two categories of laws that might apply to pen testing - ANSWER✔✔Laws pertaining to
punishment of cyber crime (hacking)
Regulatory laws that produce need for ethical hacking
Analyze the impact of the U.S. Code of Fair Information Practices on modern database systems -
ANSWER✔✔no personal record keeping system whose existence is secret
Page 3/16
