1.0 Information Security and Ethical Hacking Overview CEH Practice Quiz

• A. Confidentiality, Integrity, and Availability
• B. Compliance, Identity, and Authentication
• C. Confidentiality, Identification, and Authorization
• D. Cryptography, Integrity, and Auditing

The CIA triad. Confidentiality (preventing unauthorized disclosure of information), Integrity (ensuring data accuracy and trustworthiness), and Availability (ensuring authorized users can access resources when needed), is the foundational framework for all information security programs per EC-Council CEH v13 guidelines and NIST SP 800-12.

• A. Scanning
• B. Gaining Access
• C. Maintaining Access
• D. Covering Tracks

The CEH five-phase hacking methodology proceeds as: (1) Reconnaissance → (2) Scanning → (3) Gaining Access → (4) Maintaining Access → (5) Covering Tracks. Scanning is the active phase where attackers probe the target using tools like Nmap or Nessus to identify open ports, running services, OS versions, and potential vulnerabilities, building on passive recon data to identify attack vectors.

• A. White hat hacker
• B. Gray hat hacker
• C. Black hat hacker
• D. Script kiddie

White hat hackers (ethical hackers) are security professionals who are explicitly authorized by the target organization to perform penetration testing and vulnerability assessments. They operate under a formal Rules of Engagement or Statement of Work agreement, report all findings to the client, and work to improve the organization's security posture, the definition of an ethical hacker per EC-Council.

• A. Use of malware and unauthorized network access
• B. Targeting of a defense sector organization
• C. Use of an encrypted exfiltration channel
• D. Prolonged dwell time, targeted strategic objectives, and custom sophisticated tooling

APTs are defined by all three attributes simultaneously: Advanced (custom malware evading commercial AV, sophisticated tradecraft), Persistent (14-month dwell time, long-term strategic access rather than hit-and-run), and Threat (specific strategic objective, classified blueprints, rather than opportunistic financial gain). All three pillars together constitute the APT classification per EC-Council CEH v13 and NIST definitions.

• A. Gray box testing
• B. White box testing
• C. Crystal box testing
• D. Black box testing

Black box testing simulates a real-world external attacker with no prior knowledge of the target. The tester must rely entirely on reconnaissance and scanning techniques to discover the attack surface, mimicking the perspective of a threat actor who has obtained no insider information about the environment.

• A. Integrity, because the ransomware modified the file contents
• B. Availability, because authorized users cannot access the records
• C. Confidentiality, because the ransomware operator can read the data
• D. Non-repudiation, because the attacker's identity cannot be confirmed

Availability ensures that information and systems are accessible to authorized users when required. Ransomware that encrypts files and blocks all access is a direct attack on availability, the system may be online but is completely unusable by legitimate users, making this the dominant CIA violation in the described scenario.

• A. Integrity, then Availability
• B. Availability, then Confidentiality
• C. Integrity, then Confidentiality
• D. Confidentiality, then Availability

The attack occurred in two steps: (1) Copying PII to a USB drive = Confidentiality violation, unauthorized disclosure of sensitive personal data to an unauthorized medium. (2) Deleting the original database records = Availability violation, authorized users (other employees, systems) can no longer access that data. This insider threat targets both CIA pillars sequentially.

• A. Availability, because the transaction service may be disrupted
• B. Accountability, because audit logs will show false transaction values
• C. Integrity, because data is modified in transit without authorization
• D. Confidentiality, because the attacker can read message content

Integrity ensures that data remains accurate, complete, and unaltered during storage or transmission. A man-in-the-middle attack that modifies financial transaction amounts before forwarding is a textbook integrity violation (MITM/T1557 in MITRE ATT&CK). The receiving bank server accepts falsified data it believes is authentic.