Complete Questions with Answers and Detailed Explanations
Q1. Before initiating any security assessment on a client’s network, what documentation is critical to protect the testing team from potential legal liability?
• A. A verbal agreement with the IT manager
• B. A signed statement of work and formal authorization
• C. A list of all vulnerabilities found during the scan
• D. A handoff document for the information assurance team
✅ Correct Answer: B. A signed statement of work and formal authorization
Why B is Correct:
A signed Statement of Work (SOW) and formal written authorization provide legal proof that the testing team has explicit, documented permission to conduct security assessments. This documentation defines scope, rules of engagement, limitations, liability protections, and authorized testing windows—essential for avoiding criminal charges under laws like the Computer Fraud and Abuse Act (CFAA) or equivalent legislation worldwide.
Why Others Are Wrong:
• A. Verbal agreement: Not legally enforceable; impossible to prove in court; lacks specificity on scope, methods, and limitations.
• C. List of vulnerabilities: This is a deliverable/output of testing, not a pre-engagement legal safeguard.
• D. Handoff document: Used post-engagement for operational transition to the client team; provides zero legal protection during active testing.
Q2. You are hired to test a network where you are given IP ranges and network diagrams, but no credentials. What type of testing methodology does this describe?
• A. White Box
• B. Black Box
• C. Gray Box
• D. Blue Box
✅ Correct Answer: C. Gray Box
Why C is Correct:
Gray Box testing provides the tester with partial knowledge of the target environment. Receiving IP ranges and network diagrams constitutes insider information. However, the absence of credentials means the tester must still exploit vulnerabilities as an external attacker would, using leaked intelligence—simulating a disgruntled employee or contractor.
Why Others Are Wrong:
• A. White Box: Tester has full knowledge—source code, administrative credentials, architecture diagrams, and configuration files.
• B. Black Box: Tester has zero prior knowledge—only the target organization’s name or public domain; all intelligence must be gathered via reconnaissance.
• D. Blue Box: Not a recognized penetration testing methodology; “blue team” refers to defensive security operations.
Q3. Which operating system distribution is specifically designed with pre-loaded tools for penetration testing and security auditing?
• A. Windows Server 2019
• B. Security Onion
• C. Kali Linux
• D. Ubuntu Desktop
✅ Correct Answer: C. Kali Linux
Why C is Correct:
Kali Linux is a Debian-based distribution maintained by Offensive Security, purpose-built for penetration testing and security auditing. It ships with 600+ pre-installed tools, including Nmap, Metasploit, Burp Suite, Wireshark, John the Ripper, and more. It is the industry-standard platform for ethical hacking certifications like CEH and OSCP.
Why Others Are Wrong:
• A. Windows Server 2019: Enterprise server OS designed for hosting applications and services; not built for offensive security; lacks native penetration testing tools.
• B. Security Onion: Specialized Linux distribution for defensive security—network security monitoring (NSM), IDS/IPS, and log management—not offensive penetration testing.
• D. Ubuntu Desktop: General-purpose Linux distribution; secure and user-friendly, but requires manual installation and configuration of security testing tools.
Q4. Bollards, cipher locks, and mantraps are examples of which category of security controls?
• A. Logical Controls
• B. Administrative Controls
• C. Physical Controls
• D. Technical Controls
✅ Correct Answer: C. Physical Controls
Why C is Correct:
Physical controls protect tangible assets: facilities, hardware, personnel, and media. Bollards prevent vehicle ramming attacks; cipher locks restrict entry to authorized personnel via code; mantraps control person-throughput into secure areas by allowing only one person to pass after authentication.
Why Others Are Wrong:
• A. Logical Controls & D. Technical Controls: Synonymous terms for software or system-based protections like firewalls, encryption, access control lists (ACLs), and intrusion detection systems.
• B. Administrative Controls: Policies, procedures, standards, guidelines, training, and governance documents that direct human behavior—not physical barriers.
Q5. In a penetration test scenario where the tester has no prior knowledge of the target other than the company name, what is this assessment style called?
• A. White Box
• B. Gray Box
• C. Black Box
• D. Crystal Box
✅ Correct Answer: C. Black Box
Why C is Correct:
Black Box testing simulates an external attacker with zero insider knowledge. The tester begins with only publicly available information (company name, domain) and must perform all reconnaissance, scanning, and enumeration from scratch—providing the most realistic simulation of a real-world cyberattack.
Why Others Are Wrong:
• A. White Box: Tester is provided full internal knowledge, including source code, credentials, network maps, and administrative access.
• B. Gray Box: Tester receives partial knowledge (e.g., low-privilege credentials, network diagrams) but not full access.
• D. Crystal Box: Not a standard term in penetration testing methodology or industry frameworks.
Q6. Which international standard outlines the “Plan, Do, Check, Act” cycle for implementing and validating information security controls?
• A. NIST 800-53
• B. ISO 27002
• C. ISO 27001
• D. NIST 800-161
✅ Correct Answer: C. ISO 27001
Why C is Correct:
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It explicitly adopts the PDCA (Plan-Do-Check-Act) cycle as its core framework for risk management and control validation. ISO 27001 is also certifiable by accredited bodies.
Why Others Are Wrong:
• A. NIST 800-53: U.S. federal catalog of security and privacy controls; comprehensive but does not center on the PDCA cycle.
• B. ISO 27002: Provides best-practice guidelines for implementing controls referenced in ISO 27001, but is not certifiable and does not define the ISMS management framework.
• D. NIST 800-161: Focuses specifically on supply chain risk management for information systems, not the PDCA cycle.
Q7. You are preparing a final report for a penetration test engagement. Which section is most appropriate for the client’s senior leadership team, who may not have technical expertise?
• A. Technical Analysis Report
• B. Executive Summary Report
• C. Project Scope Document
• D. Detailed Vulnerability List
✅ Correct Answer: B. Executive Summary Report
Why B is Correct:
The Executive Summary translates technical findings into business language: risk ratings, potential financial/operational impact, compliance implications, and strategic remediation priorities. It avoids jargon and focuses on ROI, enabling C-level stakeholders to make informed risk-management decisions.
Why Others Are Wrong:
• A. Technical Analysis Report: Contains exploit code, packet captures, registry keys, and step-by-step reproduction—too granular and technical for non-technical leadership.
• C. Project Scope Document: Defines engagement boundaries, rules of engagement, and exclusions; created pre-engagement, not for reporting results.
• D. Detailed Vulnerability List: Raw CVE identifiers, CVSS scores, and technical remediation steps; valuable for IT/security teams, not executives.
Q8. Which security principle requires that critical tasks be split between two or more individuals to prevent fraud or error?
• A. Least Privilege
• B. Job Rotation
• C. Separation of Duties
• D. Mandatory Vacation
✅ Correct Answer: C. Separation of Duties
Why C is Correct:
Separation of Duties (SoD) ensures that no single individual has end-to-end control over a critical process. For example, the person who requests a payment cannot also approve and reconcile it. This preventive control reduces insider threat risk and limits opportunities for fraud or accidental error.
Why Others Are Wrong:
• A. Least Privilege: Grants users the minimum access necessary to perform their job—but does not require splitting tasks among multiple people.
• B. Job Rotation: Periodically moves staff between roles to detect fraud or burnout; a detective control that complements SoD but is not the same mechanism.
• D. Mandatory Vacation: Requires employees to take consecutive days off to uncover hidden malicious activity; also a detective control.
Q9. A manager requests that access to a file server be restricted to prevent data leaks. You warn that this may hinder employee productivity. Which element of the CIA triad is primarily at risk here?
• A. Confidentiality
• B. Integrity
• C. Availability
• D. Non-Repudiation
✅ Correct Answer: C. Availability
Why C is Correct:
Over-restricting access can prevent authorized users from accessing resources when needed for their job functions—directly impacting Availability. The CIA triad balances: Confidentiality (secrecy), Integrity (accuracy/trustworthiness), and Availability (timely, reliable access). Security decisions often involve trade-offs among these three.
Why Others Are Wrong:
• A. Confidentiality: Restricting access enhances confidentiality by limiting who can view data; this is the intended goal, not the risk.
• B. Integrity: Concerns preventing unauthorized modification or corruption of data; not directly affected by access restrictions alone.
• D. Non-Repudiation: Ensures that actions or transactions cannot be denied later (e.g., via digital signatures); unrelated to access policy trade-offs.
Q10. Your organization mandates the use of cross-cut shredders for disposing of classified documents. What type of security control is this policy?
• A. Physical Control
• B. Technical Control
• C. Administrative Control
• D. Logical Control
✅ Correct Answer: C. Administrative Control
Why C is Correct:
The policy mandating shredding is an administrative control because it is a documented procedure governing human behavior and organizational processes. Administrative controls include policies, standards, guidelines, and training that direct how security is implemented.
💡 Note: The shredder hardware itself is a physical control, but the policy requiring its use is administrative.
Why Others Are Wrong:
• A. Physical Control: Refers to tangible barriers or devices like locks, badges, biometric scanners, or the shredder unit itself—not the written policy.
• B. Technical/D. Logical Controls: Software or system-based enforcement mechanisms like Data Loss Prevention (DLP) rules that auto-delete or encrypt files.
Q11. During a policy audit, you find that security administrators are not following the published security policies. What is the best course of action?
• A. Terminate the administrators immediately.
• B. Ignore the discrepancy.
• C. Recommend regular reviews and updates to the policies.
• D. Allow administrators to create their own rules.
✅ Correct Answer: C. Recommend regular reviews and updates to the policies
Why C is Correct:
Policies that aren’t followed may be outdated, impractical, poorly communicated, or misaligned with operational realities. Recommending regular reviews ensures policies remain relevant, enforceable, and supported by training—supporting the PDCA cycle and fostering a positive security culture.
Why Others Are Wrong:
• A. Terminate immediately: Disproportionate response; ignores root causes like inadequate training, unclear policies, or resource constraints.
• B. Ignore discrepancy: Negligent; creates compliance gaps, audit failures, and increased security risk.
• D. Allow custom rules: Undermines standardization, introduces inconsistency, and weakens the overall security posture.
Q12. Which security property is primarily addressed when implementing AES encryption?
• A. Integrity
• B. Availability
• C. Confidentiality
• D. Non-Repudiation
✅ Correct Answer: C. Confidentiality
Why C is Correct:
AES (Advanced Encryption Standard) is a symmetric encryption algorithm that transforms plaintext into ciphertext. Only parties possessing the correct decryption key can recover the original data, directly ensuring that information remains secret and accessible only to authorized entities, which is the definition of Confidentiality.
Why Others Are Wrong:
• A. Integrity: Ensured by cryptographic hashing (SHA-256) or message authentication codes (HMAC), not encryption alone. Encryption does not guarantee data hasn’t been altered.
• B. Availability: Addressed via redundancy, failover systems, backups, and DDoS protection—unrelated to encryption.
• D. Non-Repudiation: Achieved through asymmetric cryptography and digital signatures (e.g., RSA, ECDSA), which provide proof of origin; symmetric encryption like AES cannot provide non-repudiation.
Q13. What is the governing council of the CEH exam?
• A. (ISC)²
• B. EC-Council
• C. CompTIA
• D. Microsoft
✅ Correct Answer: B. EC-Council
Why B is Correct:
The EC-Council (International Council of E-Commerce Consultants) is the organization that develops, administers, and certifies the Certified Ethical Hacker (CEH) program. They maintain the exam blueprint, update content to reflect emerging threats, and issue CEH credentials globally.
Why Others Are Wrong:
• A. (ISC)²: Governs certifications like CISSP, SSCP, CCSP, and CSSLP—not CEH.
• C. CompTIA: Offers vendor-neutral certifications including Security+, PenTest+, CySA+, and CASP+—competitor credentials in the cybersecurity space.
• D. Microsoft: Provides role-based certifications focused on Azure, Microsoft 365, and Windows Server—not ethical hacking.
Q14. What is one advantage an attacker has over a defender/victim?
• A. Time
• B. TOR network forums
• C. Money
• D. Metasploit
✅ Correct Answer: A. Time
Why A is Correct:
Attackers operate asymmetrically: they need to succeed only once, while defenders must be right 100% of the time. Attackers can spend weeks or months quietly reconnoitering a target; defenders must monitor, alert, and respond continuously under resource constraints and alert fatigue. This time asymmetry is a fundamental strategic advantage for adversaries.
Why Others Are Wrong:
• B. TOR network forums: A tool or resource attackers may use, but not a fundamental strategic advantage; defenders also use anonymity tools for research.
• C. Money: Enterprise defenders often have larger security budgets than individual attackers or even some criminal groups.
• D. Metasploit: An open-source exploitation framework available to both attackers and defenders (for authorized testing); tool availability is not an inherent advantage.
Q15. You are the team leader for your financial firm. You set a policy in place that all coworkers must clean off their desks, empty trash, shred sensitive documents, and secure other critical documents in their respective containers at the end of the day. What is the common name for such a policy?
• A. Clean room policy
• B. Clean desk policy
• C. Sanitization policy
• D. Wrapping up policy
✅ Correct Answer: B. Clean desk policy
Why B is Correct:
A Clean Desk Policy mandates that employees secure all physical and digital assets at the end of the workday: locking computers, storing sensitive papers in locked cabinets, shredding waste, and removing removable media. This prevents unauthorized access, social engineering, and data leakage in shared or public workspaces.
Why Others Are Wrong:
• A. Clean room policy: Refers to controlled environments for hardware manufacturing, forensic analysis, or malware research—static-free, contaminant-controlled spaces, not office hygiene.
• C. Sanitization policy: Focuses on secure data destruction methods (wiping, degaussing, cryptographic erase) for media before disposal or reuse—broader and more technical than desk hygiene.
• D. Wrapping up policy: Not a recognized term in information security frameworks or best practices.
Q16. Which of the following is considered an administrative control?
• A. Biometric device
• B. Mantrap
• C. Security policy
• D. Access control list
✅ Correct Answer: C. Security policy
Why C is Correct:
Administrative controls are procedural and people-focused: policies, standards, guidelines, training programs, risk assessments, and governance frameworks. A security policy documents organizational rules and expectations, directing human behavior to achieve security objectives.
Why Others Are Wrong:
• A. Biometric device: A physical/technical control implementing “something you are” authentication.
• B. Mantrap: A physical access control mechanism using interlocking doors to control entry.
• D. Access control list: A technical/logical control implemented in operating systems, firewalls, or routers to permit/deny traffic or access.
Q17. What is the most important task you should perform as part of a penetration test?
• A. Get informed approval
• B. Write a report
• C. Get a contract in place
• D. Compromise all systems
✅ Correct Answer: A. Get informed approval
Why A is Correct:
Informed consent and explicit written authorization are the ethical and legal foundation of penetration testing. Without documented approval specifying scope, methods, and limitations, any testing activity constitutes unauthorized access and can result in criminal prosecution, civil liability, and professional sanctions—regardless of skill or intent. This aligns with the CEH Code of Ethics and global legal frameworks.
Why Others Are Wrong:
• B. Write a report: Critical for delivering value and enabling remediation, but secondary to obtaining legal authorization to begin testing.
• C. Get a contract in place: Important for business terms, but the contract must explicitly include authorization; the approval itself is the core requirement.
• D. Compromise all systems: A tactical goal, but pursuing this without permission is illegal and unethical; not the “most important” foundational task.
Q18. Which of the following describes a “soft” control?
• A. User agreement
• B. Access control list
• C. Biometrics
• D. Security clerk
✅ Correct Answer: A. User agreement
Why A is Correct:
“Soft” controls are non-technical, human-centric measures that rely on policy, culture, training, and voluntary compliance. A user agreement (e.g., Acceptable Use Policy, NDA) sets expectations for behavior and consequences but depends on people choosing to follow it—making it a classic soft control.
Why Others Are Wrong:
• B. Access control list: A “hard” technical control enforced automatically by systems; no human discretion involved in enforcement.
• C. Biometrics: A hard physical/technical control using physiological traits; enforcement is automated and deterministic.
• D. Security clerk: A person who implements controls; the role isn’t the control type. “Soft control” refers to the mechanism (policy, training), not the actor.
Q19. What capability does a backdoor provide to the adversary?
• A. Backdoors can corrupt data software.
• B. They destroy cryptographic keys in the TPM.
• C. They provide low-level formatting operations.
• D. They provide remote access to the client.
✅ Correct Answer: D. They provide remote access to the client.
Why D is Correct:
A backdoor is a hidden method—often a malicious program, modified binary, or undocumented account—that bypasses normal authentication mechanisms. Its primary purpose is to provide attackers with persistent, stealthy remote access to a compromised system for command execution, data exfiltration, or lateral movement.
Why Others Are Wrong:
• A. Corrupt data software: Possible side effect of malware, but not the defining purpose of a backdoor.
• B. Destroy TPM keys: Highly specific and destructive; backdoors prioritize stealth and access, not sabotage.
• C. Low-level formatting: A destructive disk operation; not a typical backdoor function and would alert defenders due to system disruption.
Q20. Which of the following describes the collection of human physical attributes for use in performing electronic authentication?
• A. Personal identification card
• B. Hair and fingerprints
• C. Biometrics
• D. Type 3 control
✅ Correct Answer: C. Biometrics
Why C is Correct:
Biometrics refers to the automated measurement and statistical analysis of people’s unique physiological or behavioral characteristics for authentication. Examples include fingerprints, iris/retina scans, facial recognition, voice patterns, and keystroke dynamics.
Why Others Are Wrong:
• A. Personal identification card: Represents “something you have” (a token), not a physical attribute of the person.
• B. Hair and fingerprints: Fingerprints are a biometric, but hair alone lacks uniqueness, consistency, and measurability for reliable authentication; the option is imprecise and misleading.
• D. Type 3 control: Refers to the authentication factor category “something you are,” but “biometrics” is the precise, industry-standard term for the collection and verification process.
Q21. Which of these is not used for biometrics?
• A. Voice
• B. Iris
• C. Hair
• D. Fingerprint
✅ Correct Answer: C. Hair
Why C is Correct:
Hair lacks the necessary characteristics for reliable biometric authentication: it is not sufficiently unique across individuals, can be easily altered (cut, dyed, styled), and is difficult to measure consistently with high accuracy. No mainstream biometric system uses hair as a primary identifier.
Why Others Are Wrong:
• A. Voice: A behavioral biometric; voiceprint analysis examines pitch, tone, cadence, and spectral features for authentication.
• B. Iris: A highly unique physiological biometric; iris patterns are stable over a lifetime and widely used in high-security applications.
• D. Fingerprint: The most common and mature physiological biometric; ridge patterns are unique, persistent, and cost-effective to capture.
Q22. What is the process that changes a private IP address to a public address at the gateway?
• A. NAT
• B. PRAT
• C. GNAT
• D. NAT-T
✅ Correct Answer: A. NAT
Why A is Correct:
Network Address Translation (NAT) allows multiple devices on a private internal network (using RFC 1918 addresses like 192.168.x.x) to share one or more public IP addresses when communicating with external networks. The gateway router translates private source IPs to public IPs for outbound traffic and reverses the process for inbound replies.
Why Others Are Wrong:
• B. PRAT: Not a standard networking acronym or protocol.
• C. GNAT: Not a recognized networking term in this context (though “GNU NAT” exists in niche open-source tools, it is not relevant to standard IP translation).
• D. NAT-T (NAT Traversal): A technique that encapsulates IPsec packets in UDP to allow VPN tunnels to pass through NAT devices; it solves a compatibility problem but is not the translation process itself.
Q23. What are the two types of intrusion detection systems?
• A. NIDS and SIDS
• B. HIDS and SIDS
• C. IDS and IPS
• D. HIDS and NIDS
✅ Correct Answer: D. HIDS and NIDS
Why D is Correct:
• HIDS (Host-based Intrusion Detection System): Installed on individual endpoints; monitors system logs, file integrity, process activity, and user behavior.
• NIDS (Network-based Intrusion Detection System): Deployed at network choke points; analyzes packet traffic for signatures, anomalies, or protocol violations.
These two categories represent the primary deployment models for intrusion detection.
Why Others Are Wrong:
• A. NIDS and SIDS / B. HIDS and SIDS: “SIDS” is not a standard or recognized acronym in intrusion detection taxonomy.
• C. IDS and IPS: IPS (Intrusion Prevention System) is a related but distinct technology that actively blocks threats; the question asks for types of IDS, not IDS vs. IPS.
Q24. What is one disadvantage of a single sign-on (SSO) strategy?
• A. It offers a single point of failure for authentication.
• B. There is no replication for security policies.
• C. Passwords are stored in plain text.
• D. User accounts are easily accessible.
✅ Correct Answer: A. It offers a single point of failure for authentication.
Why A is Correct:
SSO centralizes authentication through an identity provider (IdP). If the IdP is compromised, attackers gain access to all connected applications. If the IdP experiences downtime, users lose access to all services. This concentration of risk creates a critical single point of failure that requires high availability, robust security, and disaster recovery planning.
Why Others Are Wrong:
• B. No replication for policies: Modern SSO solutions (e.g., SAML, OIDC) support policy replication and federation across domains; not an inherent flaw.
• C. Passwords stored in plain text: Reputable SSO implementations hash and salt credentials or delegate authentication to secure directories; poor implementation is not a design flaw of SSO itself.
• D. User accounts easily accessible: SSO can actually improve access governance through centralized provisioning/deprovisioning; this misrepresents the actual risk.
Q25. What is the name of the entity that may be used to hold certificates and keys in case the primary keys or certificates are unavailable?
• A. Government safe
• B. Hot site
• C. Escrow
• D. Offsite backup
✅ Correct Answer: C. Escrow
Why C is Correct:
Key or certificate escrow involves storing cryptographic keys with a trusted third party under strict legal and procedural controls. Escrow enables authorized recovery if primary keys are lost, corrupted, or if personnel are unavailable—while preventing unauthorized access through multi-party approval workflows.
Why Others Are Wrong:
• A. Government safe: Too vague and non-standard; not a defined mechanism in cryptographic key management frameworks.
• B. Hot site: A fully equipped disaster recovery facility for restoring IT operations; not specific to cryptographic key storage or access control.
• D. Offsite backup: A general term for storing data copies at a remote location; lacks the controlled-access, trust-based, and legally governed framework that defines escrow.
Q26. When a user authenticates once to a resource and is then permitted to access additional applications without the need to reauthenticate, what form of authentication is being used?
• A. Once sign-on
• B. Nonce sign-on
• C. Kerberos
• D. Single sign-on
✅ Correct Answer: D. Single sign-on
Why D is Correct:
Single Sign-On (SSO) is an authentication scheme that allows a user to log in once with a single ID and password to gain access to multiple independent software systems or applications without being prompted to log in again at each one. This improves user experience and reduces password fatigue.
Why Others Are Wrong:
• A. Once sign-on: Not a recognized term in authentication standards or literature.
• B. Nonce sign-on: “Nonce” (number used once) is a cryptographic value used to prevent replay attacks; not an authentication model.
• C. Kerberos: A specific network authentication protocol that enables SSO in Windows Active Directory environments, but SSO is the broader concept that can be implemented via Kerberos, SAML, OAuth, OIDC, etc.
Q27. What does a router separate?
• A. Collision domains
• B. Broadcast domains
• C. Switching domains
• D. Routing loops
✅ Correct Answer: B. Broadcast domains
Why B is Correct:
Routers operate at Layer 3 (Network Layer) of the OSI model and do not forward broadcast traffic (e.g., ARP requests, DHCP discovers) by default. By blocking broadcasts at interface boundaries, routers segment the network into separate broadcast domains, reducing unnecessary traffic and containing broadcast storms.
Why Others Are Wrong:
• A. Collision domains: Separated by switches (Layer 2) or bridges; in modern full-duplex switched networks, collisions are virtually eliminated.
• C. Switching domains: Not a standard networking term in OSI or TCP/IP models.
• D. Routing loops: A problem routers try to prevent using protocols like split horizon, route poisoning, or hold-down timers—not something they “separate.”
Q28. Which of the following is considered a framework for penetration testing?
• A. Metasploit
• B. Cain & Abel
• C. Nessus
• D. Security Onion
✅ Correct Answer: A. Metasploit
Why A is Correct:
The Metasploit Framework is a modular, extensible platform for developing, testing, and executing exploits. It provides structured workflows for reconnaissance, payload generation, exploitation, and post-exploitation—making it a true penetration testing framework that supports custom module development and automation.
Why Others Are Wrong:
• B. Cain & Abel: A Windows-based password recovery and network sniffing tool suite; useful for specific tasks but not a comprehensive, modular framework.
• C. Nessus: A commercial vulnerability scanner that identifies and reports weaknesses; it does not provide exploitation capabilities or a testing workflow framework.
• D. Security Onion: A Linux distribution for defensive security monitoring (IDS, NSM, log analysis); designed for blue teams, not offensive penetration testing.
💡 Note: While Metasploit is a technical framework, broader methodological frameworks like PTES (Penetration Testing Execution Standard) or the OWASP Testing Guide also exist. Among the given options, Metasploit is the only one that qualifies as a penetration testing framework.
Q29. In Windows, what command can you use to hide a file?
• A. +h attrib <filename>
• B. h+ <filename>
• C. filename attrib+h
• D. attrib +h <filename>
✅ Correct Answer: D. attrib +h <filename>
Why D is Correct:
The attrib command in Windows modifies file attributes. The syntax attrib +h <filename> adds the Hidden attribute to the specified file, causing it to not appear in normal directory listings (unless “Show hidden files” is enabled in Folder Options). Example:
attrib +h <filename>
Why Others Are Wrong:
• A. +h attrib <filename>: Incorrect syntax; attribute flags must follow the attrib command, not precede it.
• B. h+ <filename>: Not a valid Windows command; no such utility exists.
• C. filename attrib+h: Reversed order; the command (attrib) must come first, followed by flags and then the target filename.
Q30. Which of the following is a correct MAC address?
• A. 00-12-3e-ff-d4-98
• B. 3i-45-fa-90-25-1b
• C. ff-ff-ff-ff-ff-ff-fg
• D. 65-23-ab-cb-a9
✅ Correct Answer: A. 00-12-3e-ff-d4-98
Why A is Correct:
A MAC (Media Access Control) address is a 48-bit hardware identifier represented as six groups of two hexadecimal digits (0-9, A-F), separated by hyphens or colons. 00-12-3e-ff-d4-98 contains exactly six valid hex pairs and follows standard formatting.
Why Others Are Wrong:
• B. 3i-45-fa-90-25-1b: Contains the character i, which is not a valid hexadecimal digit (hex digits are 0-9 and A-F only).
• C. ff-ff-ff-ff-ff-ff-fg: Contains seven octets instead of six, and ends with g, which is not a valid hex character.
• D. 65-23-ab-cb-a9: Contains only five octets; a valid MAC address must have exactly six pairs (12 hex digits total).
🔑 Module 1 Key Takeaways
| Concept | Why It Matters |
|---|---|
| Written Authorization | Legal protection defines the scope and rules of engagement |
| Testing Methodologies | Legal protection; defines the scope and rules of engagement |
| Control Types | Physical, Administrative, Technical—know which applies to which scenario |
| CIA Triad | Every security decision impacts Confidentiality, Integrity, or Availability |
| Standards & Frameworks | ISO 27001 (PDCA), CEH (EC-Council), Metasploit (tool framework) |
| Human Factors | Clean desk policies, SoD, training address the “weakest link”: people |
| Networking Fundamentals | NAT, MAC addresses, routers vs. switches—essential for reconnaissance |
