3.0 System Hacking Phases and Attack Techniques CEH Practice Quiz

• A. External black-box assessment, simulates an outside attacker with no credentials or internal knowledge
• B. Internal white-box assessment, conducted with full network access and admin credentials
• C. Credentialed internal scan, uses valid credentials to enumerate installed software and patch levels
• D. Agent-based assessment, deploys lightweight software agents on each target host for continuous scanning

An external black-box vulnerability assessment simulates an unauthenticated attacker approaching the target from the internet. The assessor has no prior credentials, no network diagrams, and no system knowledge, they discover the attack surface entirely through scanning and enumeration. This approach identifies vulnerabilities that an external attacker could exploit without insider assistance.

• A. Continuous automated scanning, a vulnerability management platform (e.g., Tenable.sc, Rapid7 InsightVM) scans assets on a scheduled or agent-based basis and correlates results with the live NVD CVE feed
• B. Annual third-party vulnerability assessment, a contracted firm scans all systems once per year
• C. Manual penetration testing, a team of pentesters manually inspects each server weekly
• D. Point-in-time credentialed scan, a single authenticated scan run on demand when a new CVE is published

Enterprise vulnerability management platforms (Tenable.sc, Rapid7 InsightVM, Qualys, Microsoft Defender Vulnerability Management) are specifically designed for continuous, large-scale monitoring. They integrate with the NIST NVD and vendor security advisories to immediately correlate newly published CVEs against the current asset inventory and patch state, providing daily or real-time visibility into emerging exposures across thousands of assets.

• A. 9.0-10.0
• B. 7.0-8.9
• C. 4.0-6.9
• D. 0.1-3.9

CVSS v3.1 defines five severity ratings: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). A Critical rating (9.0-10.0) indicates the vulnerability is remotely exploitable with no authentication required, results in complete compromise of confidentiality, integrity, and availability, and requires no user interaction, the most severe class of vulnerabilities requiring immediate remediation.

• A. Environmental metrics allow the organization to adjust the score based on their specific deployment context, the restricted access controls likely reduce the effective exploitability, producing a lower adjusted score for this specific deployment
• B. The CVSS Base Score cannot be modified, all systems with the same CVE must be remediated at the same Critical priority regardless of their environment
• C. Applying Environmental Score automatically patches the vulnerability by removing it from the active scanning queue
• D. Environmental Score is only applicable to ICS and OT systems, IT server vulnerabilities always retain their Base Score for prioritization purposes

CVSS v3.1 Environmental metrics allow organizations to modify Base Score metrics to reflect their actual deployment: Modified Attack Vector (a network-only-exploitable vulnerability in a completely isolated network could be modified to Local), Modified Privileges Required (if MFA limits who can actually reach the service), and Confidentiality/Integrity/Availability Requirements (if the server holds low-value data, CIA requirements are lower). These modifications produce an Environmental Score that accurately reflects the actual risk to that specific organization's deployment, enabling more accurate prioritization.

• A. The scan used an incorrect vulnerability signature database, updating the NVT feed resolves the crash issue without changing scan parameters
• B. The scan used credentialed access which caused the application server to generate excessive audit log entries, filling the disk and causing the crash
• C. The OpenVAS scanner's IP address was not whitelisted by the application's rate limiting, configuring rate limit exemptions prevents future crashes
• D. The scan was configured with safe_checks disabled, enabling aggressive exploit verification tests (like sending malformed packets or fuzzing inputs) that overwhelmed the production server; safe_checks should always be enabled for production scans

OpenVAS (and Nessus) include a safe_checks parameter that, when enabled, uses passive or non-destructive tests to infer vulnerability presence. When safe_checks is disabled, the scanner runs active verification tests, sending malformed packets, fuzzing protocol inputs, or simulating denial-of-service conditions to confirm vulnerabilities. These aggressive checks can crash vulnerable services or overwhelm production servers not designed for high-volume probe traffic. For production environment scanning, safe_checks must always be enabled, scans should be conducted during maintenance windows, and aggressive checks should be reserved for dedicated test environments.

• A. Medium, because the Changed scope reduces the severity of the base score calculation
• B. Low, because Network attack vector vulnerabilities are less severe than Local
• C. High, the lack of user interaction brings the score down from Critical to High regardless of other metrics
• D. Critical, network exploitable, no auth, no user interaction, changed scope, full CIA impact is the maximum severity combination

This combination represents the most severe CVSS v3.1 profile: AV:N (remotely exploitable), AC:L (no special conditions), PR:N (no authentication), UI:N (no user interaction required), S:C (changed scope, affects beyond vulnerable component), C:H/I:H/A:H (complete impact on all CIA components). This combination produces a CVSS Base Score of 10.0, the maximum Critical rating. CVE-2021-44228 (Log4Shell) has this profile.

• A. The credentialed scan ran more slowly, giving Nessus additional time to detect vulnerabilities the faster unauthenticated scan missed
• B. The domain administrator account triggered Windows Defender to disable its own protections, exposing additional attack surface
• C. The credentialed scan generated additional false positives because administrator-level access produces more noise in the vulnerability database
• D. Authenticated scanning allows Nessus to read the Windows registry, WMI, and file system to enumerate installed software versions, missing patches, and local configuration issues that are invisible from the network layer without credentials

Unauthenticated scans probe only what is visible from the network, open ports, service banners, and externally accessible service behavior. They cannot see installed software versions, missing Windows patches (KB numbers), local user account configurations, audit policy settings, or service configurations inside the OS. Credentialed scans use the provided account to authenticate via WMI, SMB, or SSH, then read the registry (software install records, patch levels), file system (software version files), and system configuration, revealing the full patch and configuration vulnerability landscape invisible from outside.

• A. False negatives, vulnerabilities that exist but were not detected by the scanner
• B. Zero-day vulnerabilities, previously unknown issues the scanner identified incorrectly
• C. True negatives, confirmed absent vulnerabilities that the scanner correctly did not flag
• D. False positives, conditions the scanner flagged as vulnerabilities that manual review confirms are not

False positives occur when a security tool reports a condition as a vulnerability or security issue when manual investigation confirms it is actually benign or non-exploitable. In vulnerability scanning, false positives waste analyst time during triage and remediation planning. High false positive rates indicate scanner misconfiguration, aggressive plugin settings, or insufficient context about the target environment.