312-50 Question 8
Single answer▪ Hacking ConceptsDuring an authorized internal assessment, a CEH tester gains low-privilege access to a Windows workstation through a phishing simulation. The rules of engagement prohibit actions that could disrupt business operations or trigger endpoint instability. The tester wants to determine whether the current compromise can realistically lead to full system compromise or domain impact. Which action is the MOST appropriate next step within ethical hacking methodology?
- A
Attempt a controlled local privilege escalation path verification using non-destructive enumeration and a safe proof-of-concept against a known misconfiguration
- B
Launch a network-wide password spraying attack against all domain accounts to quickly measure enterprise exposure
- C
Disable the endpoint protection agent temporarily to avoid interference with post-exploitation testing
- D
Immediately deploy ransomware simulation code to validate the organization's recovery capability
Show answer and explanation
Correct answer: A
Explanation
This question tests a core hacking concept in CEH: following a structured attack methodology after initial access while respecting scope and safety constraints. In a real engagement, once a tester has a low-privilege foothold, the practical question is whether that access can be escalated or leveraged for lateral movement. The most appropriate next step is controlled post-exploitation enumeration focused on privilege escalation opportunities, because it directly measures business risk from the compromise without unnecessarily increasing impact.
This aligns with common penetration testing best practices, including rules of engagement, least-disruptive testing, and evidence-based validation. Industry guidance such as NIST SP 800-115 emphasizes planning, authorization, and minimizing adverse effects during technical testing. PTES and similar methodologies also support moving from exploitation to post-exploitation in a deliberate way, validating access level and potential impact before attempting broader or riskier actions. In CEH terms, the tester should think like an attacker, but act within legal scope and professional ethics.
- A. Correct.
Correct. After obtaining low-privilege access, the next ethical and methodical step is to assess whether privilege escalation is possible, but to do so in a controlled and non-destructive manner. This aligns with standard post-exploitation goals: validating the security impact of the foothold while minimizing operational risk. Safe enumeration of token privileges, local group membership, unquoted service paths, weak service permissions, scheduled task misconfigurations, or missing patches can demonstrate exploitability without causing instability. If a proof-of-concept is used, it should be authorized, targeted, and low risk.
- B. Incorrect.
Incorrect. Password spraying may be useful in some assessments, but in this scenario the tester already has an internal foothold on a workstation and needs to determine whether that foothold can lead to deeper compromise. A network-wide spray also introduces a higher risk of account lockouts, alerting defenders, and exceeding the least-disruptive approach required by the rules of engagement. It is not the most appropriate immediate next step.
- C. Incorrect.
Incorrect. Disabling endpoint protection is typically outside scope unless explicitly authorized and can materially change the security posture being tested. It also risks operational impact and may invalidate assessment results because the tester is no longer evaluating the environment as deployed. Ethical hacking methodology emphasizes working within authorization boundaries and avoiding unnecessary disruption.
- D. Incorrect.
Incorrect. Deploying ransomware simulation code as an immediate next step is not appropriate for validating whether the current low-privilege compromise can be escalated. Even simulated ransomware can create operational and legal concerns if not specifically approved in scope. The tester should first evaluate privilege escalation and lateral movement feasibility using controlled, minimally invasive techniques.