Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Cognizant · Ethical hacking
Practice Ethical hacking questions specifically asked in Cognizant interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
50
Tagged for this company + subject
Company
Cognizant
View company-wise questions
Subject
Ethical hacking
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Cognizant Ethical hacking round.
Ethical testing must have explicit permission from the owner. Acting without authorization, or exceeding granted permissions, risks criminal or civil penalties even if intentions are good.
permit: signed_letter(id=ENG-2025-0142, owner=ExampleCorp, assets=list)
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
VDPs guide researchers with where to report, what is allowed, and that good-faith research will not be punished. It improves safety and signal quality.
vdp: { contact: security@example.com, allowed: list, oos: list, safeHarbor: true }Confirm the host is in scope, then gather minimal situational data: whoami, hostname, network routes, patch level. Seek written approval before privilege escalation. Avoid data harvesting; prove access with a harmless file or unique token if allowed. Keep timestamps, commands, and outputs in your notes. When done, remove any artifacts you placed and help the client validate containment.
whoami && hostname && ip addr show; touch /tmp/POC_README; exit
C T logs, historical DNS, and search engines do not directly hit the target. Brute force and fuzzing are active as they send queries to target name servers or web servers.
amass enum -passive -d example.com
The org filter restricts results by organization. ASN filters by autonomous system, city filters by location, product filters by software banners.
org:"Example Corp" port:443 http.title:"login"
Start passive: whois, DNS, subdomains from C T logs and search engines. Collect tech stack from headers and icons. Enumerate public endpoints and docs. Build an asset list and rank by exposure. Only then run safe, rate-limited active checks that were approved.
whois; dig ANY; subfinder -d target; curl -I; httpx -l hosts.txt -status -tech-detect
Record source link, query or command used, timestamp, scope tag, and data hash if files were saved. Note environment like resolver or V P N exit. Add reasoning on why the item matters. This lets others reproduce and verify the same result later.
log.csv fields: time, source, query, scope_id, notes, sha256
NSE runs Lua scripts to automate discovery, enumeration, and some vulnerability checks. It is modular and runs with categories.
nmap --script=vuln -p80,443 target
Pn skips ping probes. Useful when ping is filtered, but it will try every host which can be slow.
nmap -Pn -p 80,443 203.0.113.0/24
Group by exposure and risk. First, auth surfaces like SSH, RDP, VPN, and web admin. Then legacy or risky services like SMBv1, Telnet, F T P, and outdated SSL. Check business-critical hosts next. Always validate with version detection and one proof.
nmap -sV -p 21,22,80,139,445,3389 --script banner target
Modern apps should use multi factor authentication, throttle and monitor login attempts, set secure cookie flags, and rotate or revoke sessions on key events. These are core defenses mapped in the Top 10 and WSTG authentication tests.
Set-Cookie: sid=abc; HttpOnly; Secure; SameSite=Strict
If you cannot see attacks, you cannot respond. Log important security events, protect the logs, and alert on patterns like many failed logins or access denials. This category emphasizes detection and response as part of web app defense.
Log: auth_failed, ip, user, reason, request_id; alert on spikes
Agree on a test account and a very small, slow wordlist. Set long delays between attempts and a tight maximum on requests. Watch responses for lockout, captchas, or error messages. Stop at the first sign of impact. Burp Intruder automates customized attacks, but you control speed and scope. Pair this with clear authorization and logging to keep the test safe.
Intruder → Sniper/Grep-Match → rate limit 1 req per sec → max 20 attempts on test_user
Short lived access tokens reduce blast radius. Refresh tokens allow smooth re auth. Rotation means every refresh returns a new token and invalidates the old one. This limits reuse if a token is stolen. Always use HTTPS so tokens are not exposed in transit. Also add device binding or sender constraint if possible, and store tokens securely on the client.
POST /oauth/token { grant_type: refresh_token, refresh_token: <old> }
// Server returns new access token and new refresh tokenC O R S controls which browser origins can read responses. For private data, specify exact origins you trust and require credentials only when needed. The wildcard with credentials is not allowed and would be unsafe even if it worked. Remember, CORS is a browser control. It is not an auth or firewall replacement.
Access-Control-Allow-Origin: https://app.example Access-Control-Allow-Credentials: true
Keep access tokens short lived. Store them in memory, not in URL or localStorage if you can avoid it. Use refresh tokens with rotation on a secure path that uses same site cookies. Each refresh returns a new refresh token and invalidates the old one. Bind tokens to the client context where possible, log refresh events, and revoke on logout or suspicion. This balances user experience with safety.
Access: 5–15 min Refresh: httpOnly, SameSite, rotated on use Revoke: server side blacklist or version field
Never fire a PoC without clear permission, timing, and contingency steps. Get the owner ready, understand the impact, and know how to undo changes. Safe execution keeps trust and prevents outages.
Plan: scope_ok=true; window=approved; owner_on_call; revert_steps=ready
Strong upload defense is layered. Validate type and content, never execute uploads, and isolate storage from direct web access. Scan files server-side and serve via a download endpoint, not straight from disk.
accept: ['.jpg','.png'] + magic bytes check → store /data/blobs → GET /download/:id
R C E gets you a foothold. L P E turns a low-privilege foothold into admin. In real work, attackers often do both: first land code, then escalate to broaden impact.
Flow: foothold (R C E) → enumerate → privilege escalation (L P E)
Verify written permission, scope, and the exact target list. Read the PoC code to understand actions and defaults. Test it in a lab first. Set rate limits and timeouts. Get a rollback plan and backups ready. Have the system owner and monitoring team on standby. Log everything you do and stop at first sign of instability. Never run unknown binaries. Prefer reviewed source, and remove any destructive steps. Proof should be minimal and reversible.
Checklist: scope ✔ lab test ✔ owner on-call ✔ backup ✔ revert steps ✔ logging ✔
Use out-of-band or timing-based signals that do not touch sensitive data. For timing, use a tiny, bounded delay and run it once. For out-of-band, use a controlled collaborator endpoint to receive a single DNS ping. Keep the probe minimal, log the exact time, and stop after you observe the signal. Share the smallest proof that demonstrates control, then focus on fixes. Avoid extra trials in production.
Timing probe: add a two-second delay once and measure response time O O B probe: resolve unique token.your-listener.example once
A pepper is a server side secret. Even if the database is dumped, the attacker cannot verify guesses without the pepper. Keep the pepper in a key manager, not next to the hashes.
hash = argon2id(salt || password || PEPPER_SECRET)
F I D O two uses origin bound cryptography. The key checks the real site and signs a challenge. Proxy pages cannot replay it easily. T O T P and SMS can be fooled by real time phishing.
Policy: prefer platform authenticator or roaming key; fall back to TOTP only if needed
Prefer length over weird complexity. Allow passphrases. Block known breached passwords with a deny list. Require unique passwords per system. Encourage a password manager. Pair with strong multi factor. Remove forced frequent resets; do resets only after risk events. Give clear feedback at signup and show the user if the choice is in a breach corpus.
Rules: min 12 chars; no frequent expiry; breach check; allow spaces; manager recommended; MFA required
If the client trusts any token that decodes, an attacker can use a token from a different app or a different identity provider. Always check issuer, audience, expiration, and the nonce for implicit and hybrid flows.
verify(id_token, { issuer, audience, nonce, exp })Show that escalation is possible using the smallest, reversible action. Do not chase full control if a light proof already demonstrates risk.
Proof file: echo POC_ONLY > /tmp/READ_ME_POC
A pivot lets you access subnets not directly reachable from your machine. Use approved, low-impact tunnels and keep bandwidth small.
ssh -L 8080:10.0.2.10:80 tester@pivot # local port-forward
Stop and reduce exposure. Capture only what is needed to prove the issue, never bulk-download. Hash or redact sensitive fields in notes and screenshots. Securely store evidence, restrict access, and notify the authorized owner quickly so they can contain risk. Delete any extra copies after the client confirms receipt and retention rules.
screenshot: redact(email, phone, token); store in encrypted evidence vault
Proof should be minimal. Redact sensitive fields, store securely, and coordinate with owners. Massive copies increase risk and are unnecessary.
SELECT id, LEFT(email,3)||'**' AS redacted FROM customers LIMIT 3
Use the agreed channel. Share intent before big steps. Provide timestamps, hostnames, and expected impact. If anything looks unstable, stop and alert the owner. After each milestone, summarize findings, proof, and suggested fixes in plain language. Clear, timely notes help operations stay confident and responsive.
Update format: time, host, action, expected effect, rollback, status
VLANs segment at layer two. Security enforcement still needs layer three routing, ACLs, and firewall policy. Do not treat VLAN tags as a full security boundary without controls.
Policy: VLAN10(user) ↔ VLAN30(db) = deny by default; allow only app ports
Use SNMPv3 with authentication and encryption. Restrict source IPs and interface exposure. Legacy community strings are easily sniffed and guessed.
snmp-server group SEC v3 priv snmp-server user nms SEC v3 auth sha ... priv aes ...
First, confirm scope, target subnets, and allowed test ports. Coordinate a window with ops. From a test host in the user VLAN, try only the approved DB ports and record results. Use tiny, read-only connection checks if allowed. Do not run heavy scans. If any unexpected access is open, stop and report immediately with source, destination, port, and timestamp. Share remediation ideas like deny-by-default ACLs and service allow-lists.
From VLAN20 host: 1) nc -vz db.example 1433 2) nc -vz db.example 3306 3) Record pass or block → report
Use test accounts created for the engagement. Never store real user passwords in notes. For EAP-TLS, use lab certificates or a throwaway client cert with a short lifetime. If you capture any credential material as evidence, redact secrets and keep the smallest proof. Share rotation steps with the owner before you finish.
Evidence log: time, SSID, EAP method, non-secret proof, rotation plan
IMDSv2 adds a hop-count aware session token. This reduces basic SSRF and open-proxy abuse. Pair it with egress controls and least-privilege roles.
aws ec2 modify-instance-metadata-options --http-endpoint enabled --http-tokens required --instance-id i-123456
Use minimal, verified bases. Scan dependency layers and sign images so clusters can verify provenance before running them.
docker build -t registry/app:1.2.3 . cosign sign registry/app:1.2.3 trivy image --exit-code 1 registry/app:1.2.3
Check service account tokens and permissions with kubectl using in-cluster config. List only what is allowed: namespace, pods, services, and roles. Never modify resources. Confirm if the pod can talk to the API server and which verbs work. Record exact commands and outputs. Stop if you hit errors that suggest missing rights; do not try to bypass controls.
kubectl auth can-i --list kubectl get ns kubectl get pods -A --field-selector=spec.nodeName=$(hostname)
Social engineering touches people and data. It needs clear consent, agreed scenarios, and safety rules to avoid harm and legal risk.
SE.plan: { approver: CISO, audience: sales@, pretext: invoice, dataHandled: minimal }WHOIS and A S N data reveal ownership and address ranges. This helps map external attack surface in a lawful and structured way.
whois example.com whois AS13335
UDP services may not answer, and many hosts rate limit ICMP unreachable messages. Scans rely on timeouts and retries, which increases duration.
sudo nmap -sU --top-ports 50 10.10.10.10
Use an approved target list and window. Start with conservative timing like T2 or T3. Limit ports and protocols first, then expand if stable. Monitor with the owner and stop on alert.
nmap -sS -T2 --top-ports 100 --max-retries 2 --host-timeout 30m targets.txt
Reflected and Stored XSS involve the server adding untrusted input into HTML. DOM XSS occurs when client-side JavaScript reads attacker-controlled data and sinks it into the DOM without safe handling. OWASP’s DOM XSS guidance explains this difference and why output encoding and safe DOM APIs matter.
const q = new URLSearchParams(location.search).get('q');
result.innerHTML = q; // DOM XSS sinkCSRF protection should not rely on headers that can be absent or altered. Combine server-verified anti-CSRF tokens with SameSite cookies and check content type and origin on risky endpoints. These checks are detailed across WSTG and related OWASP guidance on input and session management.
POST /transfer X-CSRF-Token: e3f... Cookie: sid=...; SameSite=Strict
B O P L A focuses on the properties inside an object. Even if a user can access the object, they may not be allowed to view or edit all fields. If the API does not validate access per field, attackers can add or modify hidden or admin only properties by guessing their names. Defend by using allow lists on what fields a role can read and write. Never bind request bodies to models without explicit field level rules.
PATCH /api/users/me { "role": "admin" } // server must ignore or block
// Use explicit field allow lists per roleStop and minimize exposure. Save only the smallest proof that shows the risk, and redact anything not needed. Use a secure vault for evidence with access logs. Note exact time, request, and response so the team can reproduce. Report quickly to the authorized contact, explain the impact in plain words, and propose a short term containment like response filtering while a proper fix is built.
Evidence log fields: time, endpoint, user role, request id, minimal redacted sample
Spraying spreads attempts over many accounts. This dodges lockouts and alert thresholds. Good defenses are multi factor, unique password rules, alerts on many distinct users failing once, and smart lockout with delay.
Detect: many users fail once with the same user agent or source
First, map routes and confirm the database and subnet are in scope. Choose a simple, reversible tunnel like SSH local or SOCKS through the foothold. Limit ports and bandwidth. Authenticate with a test account. Log start and stop times. When done, close the tunnel and confirm no processes are left behind. Share exact commands and evidence so the owner can verify.
ssh -N -L 5432:10.0.2.25:5432 tester@foothold # then connect to localhost:5432
A fake AP mimics a real SSID and often stronger signal. Clients may auto-join, exposing traffic or credentials. Wireless intrusion detection and client hardening help reduce this risk.
Defend: 802.11w PMF, WIDS/WIPS, user prompts for new BSSIDs
Keep blast radius small. Scope each role to what it must do, add conditions like tags or source VPC, and favor temporary credentials via roles.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::corp-bucket/reports/*",
"Condition": { "StringEquals": { "aws:PrincipalTag/team": "analytics" } }
}]
}Verify control-plane version and auto-upgrade. Check node OS patching and minimal images. Ensure RBAC is on and audit logs are shipped. Enforce Pod Security Standards and NetworkPolicies. Lock cloud metadata access from pods. Confirm private endpoints and restricted API access. Review IAM roles for service accounts and restrict wildcard permissions.
kubectl version --short kubectl get ns --show-labels kubectl get networkpolicy -A