312-50 Question 6
Single answer▪ Hacking Methodologies and FrameworksA retail company hires an ethical hacker to perform an authorized assessment of its external attack surface. The rules of engagement state that production systems must not be disrupted, all testing must be traceable to a defined methodology, and the final report must clearly map each activity to a recognized phase of an ethical hacking framework. During the engagement, the tester has already completed passive reconnaissance and has identified several public-facing hosts. What should the tester do NEXT to remain aligned with a standard hacking methodology while minimizing operational risk?
- A
Begin a credentialed vulnerability scan against the public-facing hosts using safe checks, then validate high-risk findings manually before attempting any exploitation
- B
Launch password-spraying attacks against all identified services to quickly determine whether weak credentials are in use
- C
Attempt exploitation immediately against the most likely vulnerable web server because exploitation is the fastest way to confirm exposure
- D
Start deleting temporary files and clearing event logs on the target hosts to avoid interfering with production operations
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because it follows the expected sequence of an ethical hacking methodology: reconnaissance first, then scanning and enumeration, followed by carefully justified exploitation if authorized. In CEH-aligned frameworks, the tester should not skip directly to exploitation without first collecting technical evidence that supports it. This sequencing also reflects widely accepted penetration testing practice in frameworks and guidance such as PTES phases (intelligence gathering, vulnerability analysis, exploitation) and NIST SP 800-115 technical testing concepts, which emphasize planning, information gathering, vulnerability identification, and controlled validation. In a production-sensitive environment, safe scanning and manual verification are essential to reduce false positives and avoid unnecessary operational impact. Options 2 and 3 are plausible because they may eventually occur during an engagement, but they are out of sequence and introduce avoidable risk. Option 4 reflects a common misconception caused by confusing adversary behavior with ethical hacking process; authorized testers document their actions rather than hide them.
- A. Correct.
Correct. In common ethical hacking methodologies, after reconnaissance comes scanning and enumeration before exploitation. Using a credentialed or otherwise carefully configured vulnerability scan with safe checks is consistent with a controlled assessment approach, especially when production stability is a requirement. Manual validation of significant findings reduces false positives and ensures that any later exploitation is justified, targeted, and within scope. This approach aligns with standard phases used in CEH-style methodology: reconnaissance, scanning/enumeration, gaining access, maintaining access, and covering tracks, while also respecting the rules of engagement.
- B. Incorrect.
Incorrect. Password spraying is an active attack technique that can affect availability, trigger account lockouts, and create unnecessary operational risk if used prematurely. While credential attacks may be in scope during some engagements, they are not the typical next step immediately after passive reconnaissance when the engagement requires minimizing disruption and following a defined methodology. A more appropriate next phase is controlled scanning and enumeration to understand the environment before attempting authentication attacks.
- C. Incorrect.
Incorrect. Jumping directly from reconnaissance to exploitation skips the scanning and enumeration phase that standard hacking methodologies rely on to identify and prioritize realistic attack paths. Immediate exploitation increases the chance of service disruption and may violate the requirement for traceable, phase-based testing. In professional assessments, exploitation should generally be targeted and supported by prior evidence from enumeration or validated vulnerability findings.
- D. Incorrect.
Incorrect. Clearing logs is associated with anti-forensics or the covering tracks phase, which is discussed in attacker methodologies but is not appropriate in a legitimate authorized assessment unless explicitly authorized for a specific objective, and even then it would be handled with extreme caution. Deleting files or logs on production systems would introduce unnecessary risk, reduce traceability, and conflict with the requirement that all tester actions be documented and non-disruptive.