Question 1

What is ethical hacking and how does it differ from malicious hacking?

Accepted Answer

Ethical hacking, also known as penetration testing or white-hat hacking, is the practice of legally breaking into computers and networks to test an organization's defenses. Ethical hackers have permission from the system owner and follow a code of conduct. Malicious hackers (black-hat) operate without permission for personal gain, harm, or theft. Ethical hacking aims to identify vulnerabilities before attackers can exploit them.

Question 2

Explain the five phases of ethical hacking.

Accepted Answer

The five phases are: 1) Reconnaissance (information gathering) – passive or active; 2) Scanning – discovering open ports, services, and vulnerabilities; 3) Gaining Access – exploiting vulnerabilities to enter the system; 4) Maintaining Access – creating backdoors for persistent access; 5) Covering Tracks – clearing logs and hiding evidence. These phases guide a penetration test.

Question 3

What is the difference between vulnerability assessment and penetration testing?

Accepted Answer

Vulnerability assessment is a systematic review to identify security weaknesses using automated tools, producing a list of potential vulnerabilities. Penetration testing is a simulated attack that exploits those vulnerabilities to determine the real-world impact and validate if they can be breached. VA is more about identification; PT is about exploitation and validation.

Question 4

What is footprinting and what are its types?

Accepted Answer

Footprinting is the process of gathering information about a target system to identify potential vulnerabilities. It is the first phase of ethical hacking. Types: Passive footprinting (collecting information without direct interaction, e.g., public records, DNS) and Active footprinting (direct interaction with the target, e.g., scanning, pinging).

Question 5

What is the OSI model and why is it relevant to network security?

Accepted Answer

The OSI model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven layers. It helps in understanding network protocols, troubleshooting, and security at each layer. For ethical hacking, knowing which layer a vulnerability belongs to helps in selecting appropriate tools and attack vectors.

Question 6

What is a vulnerability and how are they classified?

Accepted Answer

A vulnerability is a flaw or weakness in a system that could be exploited. They are classified as: 1) Critical (immediate risk), 2) High (likely to be exploited), 3) Medium (potential but less likely), 4) Low (low impact). Common classifications include CWE (Common Weakness Enumeration) and CVSS scores.

Question 7

Explain the concept of a zero-day vulnerability.

Accepted Answer

A zero-day vulnerability is a previously unknown security flaw that the vendor has not patched. It is called 'zero-day' because the vendor has zero days to address it before it can be exploited. Zero-day exploits are highly valuable and are often used in targeted attacks. Ethical hackers may discover zero-days and responsibly disclose them.

Question 8

What is reconnaissance and what are some common reconnaissance techniques?

Accepted Answer

Reconnaissance is the information-gathering phase. Techniques include: DNS enumeration (nslookup, dig), whois queries, search engine dorking (Google hacking), social media profiling, network scanning (Nmap), and social engineering. Both passive (public sources) and active (direct probing) techniques are used.

Question 9

What tools are commonly used for network scanning?

Accepted Answer

Common tools: Nmap (network mapping, port scanning), Netcat (networking utility), Wireshark (packet analyzer), Masscan (fast port scanner), and Zenmap (GUI for Nmap). They help discover hosts, services, and open ports.

Question 10

What is Nmap and what can it do?

Accepted Answer

Nmap (Network Mapper) is an open-source tool for network discovery and security auditing. It can: scan open ports, detect operating systems, identify running services, detect firewall/IDS evasion techniques, perform version detection, and script-based vulnerability detection (NSE).

Question 11

Explain the difference between TCP and UDP scanning.

Accepted Answer

TCP scanning establishes a full three-way handshake (SYN, SYN-ACK, ACK) or sends SYN packets (stealth). It is reliable for connection-oriented services. UDP scanning sends UDP packets to closed ports; responses are fewer and less reliable. UDP scanning is slower and often yields less information because many UDP services don't respond.

Question 12

What is the 'three-way handshake' in TCP and why is it important?

Accepted Answer

The TCP three-way handshake establishes a connection between client and server: SYN, SYN-ACK, ACK. It ensures both sides are ready to communicate and synchronizes sequence numbers. Understanding this is critical for network-level attacks like SYN flooding and for firewall/IDS evasion.

Question 13

What is a firewall and what are its types?

Accepted Answer

A firewall is a network security device that monitors and filters incoming/outgoing traffic based on defined rules. Types: Packet-filtering (stateless), Stateful (tracks connections), Application-level (proxy), and Next-Generation (NGFW) which adds IDS/IPS, application awareness, and deep packet inspection.

Question 14

Explain the difference between IDS and IPS.

Accepted Answer

IDS (Intrusion Detection System) monitors traffic and alerts on suspicious activity but does not block. IPS (Intrusion Prevention System) actively blocks or mitigates threats in real time. Both use signatures or anomaly detection. IPS is placed inline with the traffic; IDS is out-of-band.

Question 15

What is a DMZ and why is it used?

Accepted Answer

A DMZ (Demilitarized Zone) is a separate network that exposes external-facing services (web servers, email) to the internet while isolating the internal network. It adds a layer of security: if an attacker compromises a DMZ server, they still cannot access the internal network without additional exploitation.

Question 16

Explain SQL injection and how it can be prevented.

Accepted Answer

SQL injection is an attack where malicious SQL code is inserted into input fields to manipulate database queries. Prevention: use parameterized queries (prepared statements), input validation, stored procedures, least privilege database accounts, and web application firewalls (WAF).

Question 17

What is Cross-Site Scripting (XSS) and what are its types?

Accepted Answer

XSS is a vulnerability that allows attackers to inject client-side scripts into web pages viewed by others. Types: Reflected (input is reflected from server), Stored (persistent, stored in DB), DOM-based (executed via DOM manipulation). Prevention: output encoding, context-aware escaping, Content Security Policy (CSP).

Question 18

What is CSRF (Cross-Site Request Forgery) and how is it mitigated?

Accepted Answer

CSRF tricks a user's browser into making an unwanted request to a site where the user is authenticated. It leverages session cookies. Mitigation: CSRF tokens (synchronizer tokens), SameSite cookie attribute (Strict/Lax), and requiring re-authentication for sensitive operations.

Question 19

What is the difference between authentication and authorization?

Accepted Answer

Authentication verifies who a user is (login credentials). Authorization determines what a user can do (permissions, roles). Authentication precedes authorization. In ethical hacking, testing both is crucial for identifying privilege escalation and weak authentication mechanisms.

Question 20

What is session hijacking and how is it prevented?

Accepted Answer

Session hijacking is stealing a user's session ID to impersonate them. It can be done via packet sniffing, XSS, or brute-forcing. Prevention: use HTTPS, secure cookies (HttpOnly, Secure flags), regenerate session IDs after login, and implement short session timeouts.

Question 21

Explain the concept of privilege escalation.

Accepted Answer

Privilege escalation is when an attacker gains higher-level permissions than initially intended. There are two types: Vertical (gaining administrator/root access) and Horizontal (accessing another user's resources). It can be achieved via kernel exploits, misconfigured permissions, or software vulnerabilities.

Question 22

What is a buffer overflow and how can it be exploited?

Accepted Answer

A buffer overflow occurs when data exceeds the buffer size and overwrites adjacent memory. An attacker can inject code into the overflowed space to execute arbitrary commands. Prevention: use bounds-checking functions, ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), and compile-time checks.

Question 23

What is the Metasploit Framework and what is it used for?

Accepted Answer

Metasploit is an open-source penetration testing tool that provides a wide range of exploits, payloads, encoders, and post-exploitation modules. It enables ethical hackers to simulate attacks, test vulnerabilities, and assess security. It also includes auxiliary modules for scanning, fuzzing, and reconnaissance.

Question 24

What is a payload in the context of exploitation?

Accepted Answer

A payload is code that executes after a successful exploit. It can be a reverse shell, bind shell, Meterpreter session (advanced interactive shell), or a system command. Payloads provide the attacker with control over the compromised system.

Question 25

Explain the difference between a shell and a reverse shell.

Accepted Answer

A shell is a command-line interface. A bind shell opens a port on the target for the attacker to connect. A reverse shell makes the target connect back to the attacker's machine, which often bypasses firewalls (outbound traffic is less restricted). Reverse shells are more common in real-world attacks.

Question 26

What is the difference between active and passive reconnaissance?

Accepted Answer

Active reconnaissance involves direct interaction with the target (e.g., scanning, pinging), which may be logged and detected. Passive reconnaissance uses publicly available information without touching the target (e.g., Google search, social media, WHOIS). Active is faster but riskier; passive is stealthier.

Question 27

What is a packet sniffer and what can it be used for?

Accepted Answer

A packet sniffer (e.g., Wireshark, tcpdump) captures network packets traveling over the network. It can be used to analyze network traffic, troubleshoot, or sniff sensitive information (like passwords, if unencrypted). Ethical hackers use it to identify insecure protocols and data leaks.

Question 28

Explain the concept of man-in-the-middle (MITM) attacks.

Accepted Answer

A MITM attack occurs when an attacker intercepts and possibly alters communication between two parties without their knowledge. It can be done via ARP spoofing, DNS spoofing, or rogue access points. Prevention: use encryption (TLS), strong authentication, and ARP spoofing detection.

Question 29

What is ARP spoofing and how can it be prevented?

Accepted Answer

ARP spoofing (ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC address with a legitimate IP, allowing traffic interception. Prevention: use static ARP entries, ARP monitoring tools, port security on switches, and encryption (HTTPS).

Question 30

What is a port scan and what information can it reveal?

Accepted Answer

A port scan sends requests to target ports to determine which are open, closed, or filtered. It reveals open services (e.g., HTTP on port 80, SSH on 22), which may be vulnerable. Ethical hackers use port scans to identify attack surfaces. Common tools: Nmap, Masscan.

Question 31

What is a vulnerability scanner and how does it work?

Accepted Answer

A vulnerability scanner (e.g., Nessus, OpenVAS) automatically scans systems for known vulnerabilities by checking version numbers, patch levels, and configuration issues. It uses a database of signatures and then generates a report. It does not exploit vulnerabilities—it identifies potential weaknesses.

Question 32

Explain the difference between a white-box, black-box, and gray-box test.

Accepted Answer

White-box: full knowledge of internal architecture and code. Black-box: no prior knowledge, simulating an external attacker. Gray-box: partial knowledge, often with internal access. These testing methodologies determine the depth and scope of the penetration test.

Question 33

What is a security audit and how does it differ from a penetration test?

Accepted Answer

A security audit is a systematic evaluation of an organization's security policies, controls, and procedures against a standard (e.g., ISO 27001). It is often compliance-driven. A penetration test is a hands-on simulated attack to find vulnerabilities. Audits are broader; PT is technical and exploitative.

Question 34

What is the OWASP Top 10 and why is it important for ethical hackers?

Accepted Answer

The OWASP Top 10 is a list of the most critical web application security risks, such as Injection, Broken Access Control, XSS, etc. Ethical hackers use it as a baseline for testing web applications, ensuring they cover the most common and dangerous vulnerabilities.

Question 35

What is social engineering and why is it a significant threat?

Accepted Answer

Social engineering is manipulating people into divulging confidential information or performing actions. It bypasses technical controls by targeting human psychology. It's a major threat because even the best technical security can be undermined by a user's error. Examples: phishing, pretexting, baiting.

Question 36

What is phishing and how can it be detected?

Accepted Answer

Phishing is a type of social engineering where attackers send fraudulent emails or messages that appear to come from legitimate sources to steal personal info. Detection: check sender address, hover over links to see URL, look for urgent language, grammatical errors, and verify with the source through a trusted channel.

Question 37

What is a honeypot and what is its purpose?

Accepted Answer

A honeypot is a decoy system that looks like a legitimate target but is actually isolated and monitored. Its purpose is to: attract attackers, study their behavior, detect intrusion attempts, and distract them from real assets. It can be low-interaction (emulated) or high-interaction (real OS).

Question 38

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric uses one shared key for encryption/decryption (e.g., AES); fast but key distribution is hard. Asymmetric uses a key pair (public/private) for encryption/decryption or signing (e.g., RSA); solves key exchange but slower. Ethical hackers must understand both to evaluate crypto implementations.

Question 39

What is a digital certificate and what role does it play in security?

Accepted Answer

A digital certificate is an electronic document that binds a public key to an entity's identity. It is issued by a Certificate Authority (CA) and is used to establish trust in SSL/TLS, email encryption, and code signing. It enables secure communication by verifying the server's identity.

Question 40

What is a DoS (Denial of Service) attack and how does it work?

Accepted Answer

DoS attacks overwhelm a service with excessive traffic, making it unavailable to legitimate users. It can exploit vulnerabilities like buffer overflows or simply flood the network. DDoS is a distributed version using multiple compromised systems. Prevention: rate limiting, load balancing, and cloud-based scrubbing services.

Question 41

What is the difference between hashing and encryption?

Accepted Answer

Hashing is a one-way function (e.g., SHA-256) that creates a fixed-size digest from input, primarily used for integrity and password storage. Encryption is reversible with a key (e.g., AES), providing confidentiality. Hashes cannot be reversed; encryption can.

Question 42

What is a rainbow table and how is it used?

Accepted Answer

A rainbow table is a precomputed table for reversing cryptographic hash functions. It stores pairs of plaintext passwords and their hashes, allowing fast lookup to crack hashed passwords. Prevention: use salting (adding random data to passwords before hashing) to make rainbow tables ineffective.

Question 43

What is steganography and how can it be used in hacking?

Accepted Answer

Steganography is hiding data within other seemingly harmless data (e.g., hiding text in images, audio). Attackers can use it to exfiltrate data without detection or to embed malicious code. Ethical hackers should be aware of steganographic techniques to detect data leakage.

Question 44

Explain the concept of a Trojan horse and how it differs from a virus.

Accepted Answer

A Trojan horse is malicious software disguised as legitimate software. It does not self-replicate (unlike viruses/worms). It relies on user interaction to install. Viruses replicate and attach themselves to files. Trojans often create backdoors or perform spy activities.

Question 45

What is a rootkit and how does it evade detection?

Accepted Answer

A rootkit is a set of tools used by an attacker to hide their presence on a compromised system. It modifies kernel-level processes, system calls, and file lists to conceal processes, files, and network connections. Detection requires specialized tools and offline analysis.

Question 46

What is the difference between black box and white box testing in security?

Accepted Answer

Black box testing: tester has no knowledge of the internal system architecture; simulates an external attacker. White box testing: tester has full knowledge of source code, design, and infrastructure; simulates a knowledgeable insider. Gray box is a mix.

Question 47

What is a security incident response plan and why is it important?

Accepted Answer

An incident response plan is a documented strategy for handling security breaches. It outlines roles, procedures, communication, and containment. Importance: minimizes damage, ensures timely response, preserves evidence, and facilitates recovery. It's critical for compliance and business continuity.

Question 48

Explain the concept of 'least privilege' in the context of ethical hacking.

Accepted Answer

Least privilege means granting users or processes only the minimum permissions needed to perform their tasks. For ethical hackers, this principle is critical when assessing systems: misconfigurations that violate least privilege can lead to privilege escalation vulnerabilities. Enforcement reduces attack surface.

Question 49

What is the role of a CISO (Chief Information Security Officer) in an organization?

Accepted Answer

The CISO is the executive responsible for an organization's information and data security strategy. They manage security policies, risk management, compliance, incident response, and the security team. They align security with business goals and report to senior management.

Question 50

What are some emerging trends in ethical hacking and cybersecurity?

Accepted Answer

Emerging trends: AI/ML for threat detection and automated penetration testing; ransomware-as-a-service; cloud-native security; zero trust architecture; supply chain attacks; deepfake-based social engineering; IoT/OT security challenges; quantum computing threats to cryptography; and increased regulatory focus. Ethical hackers must stay updated with these trends.

Ethical Hacking Q&A