Quiz

# Ethical hacking quiz

1) Before any active testing on a third-party system, you must have:
   a) a personal goal
   b) signed Rules of Engagement (RoE) with the asset owner
   c) a reseller agreement
   d) a CVE assigned

2) During an engagement, you find PII you did not expect. You should:
   a) keep going - that is the engagement
   b) immediately stop, document, and notify the asset owner
   c) post a redacted screenshot to LinkedIn
   d) decrypt it for proof

3) A bug bounty programme's scope page is:
   a) suggestions
   b) a legal contract that determines lawful testing
   c) only relevant for payouts
   d) outdated

4) The right first step in an IR for a confirmed credential compromise:
   a) power off the workstation
   b) preserve evidence (memory + disk image) then contain (revoke tokens, sessions, rotate creds)
   c) wipe and reinstall
   d) post to the company Slack

5) Detection rules should be tied to:
   a) vendor tool names
   b) MITRE ATT&CK techniques (TTPs)
   c) IP block lists alone
   d) annual compliance scans

6) Out-of-band comms during a major IR matter because:
   a) speed
   b) the primary channel may be compromised; preserve confidentiality
   c) cost savings
   d) tradition

7) Coordinated vulnerability disclosure (CVD):
   a) means publish first
   b) coordinates a fix between researcher and vendor before public disclosure
   c) replaces patching
   d) waives liability

8) Purple-team exercises succeed when:
   a) red 'wins'
   b) detections are added or tuned; coverage matrix improves
   c) headlines are made
   d) management gets a slide deck

Answers: 1b, 2b, 3b, 4b, 5b, 6b, 7b, 8b.

# 3 questions per lesson.