312-50 Question 12
Single answer▪ Ethical Hacking ConceptsA financial services company hires an external security consultant to assess the resilience of its newly deployed customer portal. The statement of work authorizes testing only against the portal's public IP range during a two-week window and explicitly prohibits phishing, denial-of-service, and testing any third-party hosted services. During reconnaissance, the consultant discovers that the portal uses a cloud-based payment API hosted by another vendor and identifies a misconfiguration in that API integration that might expose transaction metadata. What is the MOST appropriate next step for the consultant from an ethical hacking and professional practice perspective?
- A
Exploit the exposed API integration immediately to collect proof of impact, because identifying real risk is the primary goal of any penetration test
- B
Document the finding, stop short of interacting with the third-party API beyond the authorized scope, and notify the client so scope can be clarified or expanded through formal approval
- C
Contact the third-party payment provider directly and begin coordinated testing with them, since the issue affects the client's environment
- D
Continue passive reconnaissance on the third-party service and attempt limited authentication bypass testing because it is indirectly connected to the target portal
Show answer and explanation
Correct answer: B
Explanation
The key ethical hacking concept being tested is adherence to authorization, scope, and rules of engagement. In CEH-style scenarios, the correct answer is the one that keeps the tester within documented permission boundaries, even when a potentially serious issue is identified. Ethical hackers are authorized professionals, not unrestricted attackers. Standard penetration testing practice requires a signed scope, clear constraints, communication procedures, and formal change control for any expansion of targets or techniques. This aligns with common industry guidance in penetration testing standards and rules-of-engagement documentation, such as the need for written authorization and explicit target definition emphasized by frameworks like NIST technical guidance on security testing and industry methodologies such as PTES. The consultant should therefore report the finding, avoid unauthorized validation of the third-party API, and seek formal approval if further testing is required.
- A. Incorrect.
This is incorrect because ethical hacking is governed by explicit authorization and scope. Even if exploiting the issue could demonstrate business impact, interacting with a third-party API that is outside the approved target list would exceed the rules of engagement. In a real engagement, unauthorized testing can create legal, contractual, and operational risk for both the tester and the client.
- B. Correct.
This is correct because it follows core ethical hacking principles: obtain clear authorization, stay within the defined scope, and escalate out-of-scope findings through the agreed communication channel. The consultant can responsibly report the suspected exposure, preserve evidence gathered from authorized reconnaissance, and request written approval before performing any additional validation involving the third-party service.
- C. Incorrect.
This is incorrect because the consultant's contract is with the client, not automatically with the third-party provider. Even if direct coordination might eventually be appropriate, the tester should not independently expand the engagement. Proper procedure is to notify the client and obtain formal authorization and scope adjustment before any contact or testing occurs.
- D. Incorrect.
This is incorrect because 'limited' testing is still testing. Passive observation may be acceptable only if it remains strictly within the authorized target and does not involve probing the third-party service itself. Attempting authentication bypass is active testing and would clearly violate the stated prohibition on testing third-party hosted services.