312-50 Question 5
Single answer▪ Hacking Methodologies and FrameworksA company hires a CEH-certified consultant to perform an authorized external penetration test against its internet-facing environment. The rules of engagement state that the engagement must follow a recognized hacking methodology, produce evidence suitable for remediation planning, and avoid unnecessary disruption to production systems. After completing reconnaissance and active scanning, the consultant identifies a likely misconfigured web application and an exposed administrative service. According to a standard ethical hacking methodology, what should the consultant do NEXT?
- A
Begin a full denial-of-service stress test against both targets to verify business impact before exploitation
- B
Move into gaining access by attempting controlled exploitation of the identified weaknesses within the approved scope and rules of engagement
- C
Skip exploitation and proceed directly to covering tracks so the client's logging and monitoring controls can be evaluated realistically
- D
Immediately start post-exploitation persistence activities on all discovered hosts to determine long-term access feasibility
Show answer and explanation
Correct answer: B
Explanation
In CEH-aligned hacking methodology, the typical sequence is reconnaissance/footprinting, scanning and enumeration, gaining access, maintaining access or post-exploitation where authorized, and then reporting. In practical penetration testing frameworks and industry guidance, including PTES and NIST SP 800-115, findings from scanning should be validated through controlled exploitation rather than assumed to be exploitable. This produces actionable evidence for remediation while keeping activity within the rules of engagement. Denial-of-service testing is often restricted because of operational risk, and anti-forensics actions such as covering tracks are generally inappropriate in standard enterprise penetration tests unless specifically authorized for a narrowly defined objective. Therefore, the most appropriate next step is to attempt controlled exploitation of the identified weaknesses within the approved scope.
- A. Incorrect.
This is incorrect. In common ethical hacking and penetration testing methodologies, denial-of-service testing is typically excluded or tightly controlled because it can disrupt production systems. The scenario explicitly says to avoid unnecessary disruption. After reconnaissance and scanning, the next logical phase is not stress testing but validating vulnerabilities in a controlled manner.
- B. Correct.
This is correct. Standard hacking methodologies used in CEH-style workflows generally progress from reconnaissance to scanning/enumeration, then to gaining access (controlled exploitation), followed by maintaining access/post-exploitation where authorized, and finally reporting/covering tracks in attacker models. Because the consultant has already completed reconnaissance and active scanning and has identified likely weaknesses, the next step is to attempt controlled exploitation within scope to validate whether the findings are actually exploitable.
- C. Incorrect.
This is incorrect. Covering tracks is associated with attacker behavior, not a normal next step in an ethical hacking engagement. In a legitimate penetration test, evidence collection and preservation are important, and testers should not erase logs unless the objective explicitly includes testing detection and anti-forensics under tightly defined approval. Skipping exploitation would also prevent validation of the identified weaknesses.
- D. Incorrect.
This is incorrect. Persistence or maintaining access comes after successful exploitation and only if explicitly authorized in the scope. Starting persistence activities before validating initial access does not follow recognized methodology and would exceed what is necessary at this stage. It also increases operational risk on production systems.