Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Ethical hacking · Question Set
Ethics & Method interview questions for placements and exams.
Questions
15
Included in this set
Subject
Ethical hacking
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Ethical hacking.
Follow the emergency path in the Rules of Engagement. Stop the test, contact the on-call owner, share what you did and the exact timing, and help with rollback. Document the incident, lessons learned, and safeguard changes so it does not repeat. Transparency preserves trust.
onError: stop(); notify(oncall); provide steps_to_revert; log(event)
For complete preparation, combine this set with full subject-wise practice for Ethical hacking. You can also explore other subjects and sets from the links below.
Abuse testing can lock out users or flood logs. Use a test account, tiny volumes, and rate limits agreed in advance to avoid user impact.
authTest: account=test_user; maxAttempts=20; rate=1/min; stopOnAlert=true
Authorization proves consent and sets legal and safety limits. A good scope lists in-scope assets, time windows, contact paths, and what is out of bounds. This avoids accidental disruption and legal trouble.
Scope: targets=[api.example.com, 203.0.113.0/24]; OOS=[prod-db]; window=Sat 01:00–05:00; emergency=+1-555-0100
Ethical testing must have explicit permission from the owner. Acting without authorization, or exceeding granted permissions, risks criminal or civil penalties even if intentions are good.
permit: signed_letter(id=ENG-2025-0142, owner=ExampleCorp, assets=list)
Safe Harbor language states that if you follow program rules, the organization will not pursue legal action. It encourages responsible testing and clear reporting.
policy.safeHarbor: { goodFaith: true, followRules: true, noLegalAction: true }DoS can disrupt business. Most engagements forbid it unless there is an approved window, a lab environment, and explicit sign-off.
if (!scope.flags.allowDoS) { skip("no-DoS"); }NIST guidance emphasizes planning and authorization, then structured testing, analysis, and mitigation. This turns results into action and controls risk.
steps = ["plan", "test", "analyze", "mitigate"]
VDPs guide researchers with where to report, what is allowed, and that good-faith research will not be punished. It improves safety and signal quality.
vdp: { contact: security@example.com, allowed: list, oos: list, safeHarbor: true }Lead with risk and business impact in plain language. Show a simple proof of how to reproduce. Explain root cause and the likely attacker path. Provide concrete fixes and a quick mitigation if a full fix takes time. Close with validation steps so teams know when it is done. Keep it precise, respectful, and easy to read by both engineers and managers.
Finding: Broken access control → Impact: read other users’ invoices → Repro: GET /api/invoices/42 → Fix: enforce owner check
First, do no harm: prefer low-risk tests and avoid disruption. Second, respect privacy: minimize data collection and handle any sensitive data carefully. Third, act with integrity: be transparent, stay within scope, and report issues promptly. These build trust and keep testing both safe and useful.
Principles: minimize_impact; protect_data; follow_scope
Confirm the host is in scope, then gather minimal situational data: whoami, hostname, network routes, patch level. Seek written approval before privilege escalation. Avoid data harvesting; prove access with a harmless file or unique token if allowed. Keep timestamps, commands, and outputs in your notes. When done, remove any artifacts you placed and help the client validate containment.
whoami && hostname && ip addr show; touch /tmp/POC_README; exit
Stop and reduce exposure. Capture only what is needed to prove the issue, never bulk-download. Hash or redact sensitive fields in notes and screenshots. Securely store evidence, restrict access, and notify the authorized owner quickly so they can contain risk. Delete any extra copies after the client confirms receipt and retention rules.
screenshot: redact(email, phone, token); store in encrypted evidence vault
PTES starts before any testing with approvals and planning, then moves from information gathering to modeling, finding weaknesses, safely exploiting, learning more on post-exploitation, and finally reporting.
flow = ["pre", "recon", "model", "vuln", "exploit", "post", "report"]
Social engineering touches people and data. It needs clear consent, agreed scenarios, and safety rules to avoid harm and legal risk.
SE.plan: { approver: CISO, audience: sales@, pretext: invoice, dataHandled: minimal }A chain of custody records every transfer and control action on evidence. It proves data was not altered and maintains trust in findings.
entry = { time, handler, action, itemHash, location } // append to evidence log