312-50 Question 9
Single answer▪ Hacking ConceptsDuring an authorized internal assessment, a CEH tester gains access to a Linux web server using a low-privilege service account. The server hosts a customer-facing application, and the rules of engagement state that the tester must demonstrate business impact while avoiding actions that could disrupt production services or alter sensitive customer data. Which action best aligns with the hacking concept of maintaining safe proof of access while still demonstrating meaningful post-exploitation capability?
- A
Dump the entire customer database and copy it to the tester's workstation to prove data access
- B
Create a temporary file in a controlled test directory, capture screenshots of access to limited non-sensitive configuration data, and document the commands used
- C
Install a persistent remote access service so the tester can reconnect later without repeating exploitation steps
- D
Modify firewall rules on the server to show that network controls can be bypassed from the compromised host
Show answer and explanation
Correct answer: B
Explanation
The best answer is Option 2 because ethical hacking is not only about what can be done after compromise, but also about how to validate findings responsibly. In a real engagement, once initial access is achieved, the tester should demonstrate impact using the least invasive method possible. Common best practices include obtaining explicit authorization, following rules of engagement, minimizing data collection, avoiding persistence unless approved, preserving system stability, and maintaining an evidence trail with screenshots, command history, and timestamps. This approach is consistent with professional penetration testing standards and guidance such as NIST SP 800-115, which emphasizes planning, scope adherence, and careful execution of technical testing activities. It also reflects the CEH concept that successful exploitation must be balanced with ethics, safety, and business-aware decision-making.
- A. Incorrect.
This is incorrect because copying the entire customer database exceeds what is typically necessary to prove access and introduces unnecessary risk to confidentiality, privacy, and scope compliance. In an ethical hacking engagement, the tester should follow data minimization principles and collect only the minimum evidence required to demonstrate impact. A candidate might choose this option because it seems like the strongest proof, but on a production system it is not the safest or most professional approach.
- B. Correct.
This is correct because it demonstrates controlled post-exploitation activity with minimal operational impact. Creating a harmless artifact in an approved location and documenting limited access to non-sensitive information proves the tester obtained meaningful access without unnecessarily exposing customer data or disrupting service. This aligns with core ethical hacking concepts: operate within authorization, minimize harm, preserve evidence, and demonstrate impact safely.
- C. Incorrect.
This is incorrect because installing persistence changes the target environment in a way that can create operational and security risk. Unless persistence is explicitly authorized in scope and carefully coordinated, adding a remote access service is not an appropriate default action on a production server. A candidate might select this because persistence is a real attacker behavior, but CEH emphasizes controlled, authorized actions rather than unnecessary emulation of destructive or risky attacker techniques.
- D. Incorrect.
This is incorrect because modifying firewall rules on a production system can affect availability, segmentation, and downstream services. Even if the goal is to prove pivoting or control over host networking, this action is more invasive than necessary and can violate the requirement to avoid disruption. Testers should prefer non-destructive evidence collection over configuration changes that may alter security posture.