Pass the CertiProf Ethical Hacking Professional CEHPC Questions and answers with CertsForce

An Acceptable Use Policy (AUP) is a foundational administrative control and a formal document that outlines the rules and behaviors expected of employees, contractors, and other stakeholders when using an organization’s information technology assets. These assets include computers, networks, internet access, email systems, and mobile devices. The primary purpose of an AUP is to protect the organization from legal liability, security breaches, and productivity losses by clearly defining what constitutes "acceptable" versus "forbidden" activity.

A robust AUP typically covers several key areas:

Prohibited Activities: Explicitly forbidding illegal acts, harassment, accessing inappropriate content (such as pornography), or using company resources for personal gain.

Data Protection: Requiring employees to protect passwords and sensitive data, and forbidding the unauthorized installation of software.

Monitoring and Privacy: Informing users that the company reserves the right to monitor network traffic and that there is no expectation of privacy on corporate systems.

Consequences: Stating the disciplinary actions that will be taken if the policy is violated.

From an ethical hacking and auditing perspective, the AUP is often the first document reviewed. If a user’s poor security habits lead to a breach, the AUP provides the legal and administrative framework for the organization to respond. Furthermore, a well-communicated AUP serves as a "deterrent control," discouraging employees from engaging in risky behaviors that could open the door to social engineering or malware infections. It is a critical component of "Governance, Risk, and Compliance" (GRC) within any enterprise.

Hacktivism is a modern security trend that sits at the intersection of computer hacking and social activism. A "hacktivist" is an individual or a member of a group who uses their technical expertise to gain unauthorized access to systems or disrupt digital services to promote a specific political, social, or ideological agenda. Unlike traditional cybercriminals who are typically motivated by financial gain, or state-sponsored actors seeking geopolitical intelligence, hacktivists act as "digital protesters." Their goal is often to draw public attention to perceived injustices, government policies, or corporate misconduct.

Common tactics used by hacktivists include Distributed Denial of Service (DDoS) attacks to take down a target's website, "defacing" web pages with political messages, or leaking confidential internal documents (often referred to as "doxxing") to embarrass or expose the target. High-profile groups like Anonymous or WikiLeaks are frequently cited as examples of this phenomenon. While the hacktivist might believe their actions are morally justified by their cause—be it environmental protection, free speech, or human rights—their actions remain illegal under most international and domestic computer crime laws because they involve unauthorized access or disruption of service.

From a defensive standpoint, hacktivism represents a unique threat profile. Organizations must monitor the social and political climate to gauge if they might become a target of a hacktivist campaign. For instance, a company involved in a controversial project might see a sudden surge in scan attempts or phishing attacks. Understanding hacktivism is essential for modern threat intelligence, as it requires security teams to look beyond technical vulnerabilities and consider the reputational and ideological factors that might drive an attack. This trend highlights how the digital realm has become a primary battlefield for social discourse and political conflict in the 21st century.

Google Hacking, also known as Google Dorking, is a powerful reconnaissance strategy that involves using advanced search operators within the Google search engine to identify sensitive information or vulnerabilities that are inadvertently exposed on the public internet. By utilizing specific syntax—such as site:, filetype:, intitle:, and inurl:—an attacker or an ethical hacker can filter search results to find "low-hanging fruit" that would be impossible to locate with a standard query.

Common targets of Google Hacking include exposed database configuration files (which might contain passwords), server logs that reveal internal IP addresses, and "Index of" directories that provide a raw view of a server's file structure. For example, a search like filetype:env "DB_PASSWORD" could potentially reveal environment variables for web applications. This is an essential attack vector to mitigate because it requires no specialized hacking software; it simply exploits the fact that Google's crawlers have indexed files that administrators forgot to protect or hide via robots.txt.

Managing this vector involves "Self-Dorking"—regularly searching one's own domain using these advanced techniques to see what information is visible to the public. Mitigation strategies include proper server configuration, ensuring that sensitive files are not stored in the webroot, and using authentication for all administrative interfaces. From a penetration testing perspective, Google Hacking is part of the "Passive Reconnaissance" phase, allowing a tester to gather intelligence about a target's infrastructure without ever sending a single packet directly to the target's servers. This highlights how easily information leakage can lead to a full system compromise if not actively monitored.

In ethical hacking and penetration testing, a dictionary used for brute-force or dictionary attacks is afile containing a list of potential passwordsthat an attacker or tester attempts against a target authentication mechanism. Therefore, option C is the correct answer.

Dictionary files are typically plain text documents that include commonly used passwords, leaked credentials, default passwords, variations of words, and patterns frequently chosen by users. Ethical hackers use these dictionaries duringpassword auditing and authentication testingto assess the strength of password policies implemented by an organization.

Option A is incorrect because a traditional language dictionary explains word meanings and is not structured for authentication testing. Option B is also incorrect because passwords are not normally stored in readable plain text documents; secure systems store passwords using hashing and salting mechanisms.

From a security perspective, dictionary attacks exploithuman behavior, particularly the tendency to choose weak or predictable passwords. Ethical hackers simulate these attacks in controlled environments to demonstrate the risks of poor password hygiene. The results help organizations enforce stronger password policies, multi-factor authentication, and account lockout mechanisms.

Understanding dictionary-based brute-force attacks is essential for managing attack vectors, as credential compromise remains one of the most common entry points for attackers. Ethical use of dictionaries allows organizations to proactively identify weaknesses before malicious actors exploit them.

Geolocation phishing is an advanced social engineering technique used to trick a victim into revealing their precise physical location. This is typically achieved by sending the target a link to a deceptive web page that appears to offer a legitimate service or interesting content. When the user clicks the link, the page requests permission to access the device's location services (GPS). If the user clicks "Allow," the exact coordinates are transmitted back to the attacker.

One of the most prominent tools used in the ethical hacking course for this purpose isSeeker. Seeker is an open-source tool that creates a fake website—often mimicking a "Near Me" service or a weather app—to entice the user into sharing their location. Unlike standard IP-based geolocation, which only provides a general area based on the Internet Service Provider's location, Seeker uses the device's actual GPS data to provide accuracy within meters.

This technique is a powerful example of how attackers can combine technical vulnerabilities with human psychology. In a professional penetration test, geolocation phishing might be used to demonstrate how an executive could be tracked or how a remote worker’s location could be compromised. Defending against this threat requires high user awareness: individuals should never grant location permissions to unfamiliar websites or links received via unsolicited emails or messages. It highlights that sensitive data isn't just limited to passwords; it also includes the physical whereabouts of individuals.

In the professional penetration testing process, the discovery of a "critical" vulnerability—one that could lead to immediate system compromise or data loss—triggers a specific ethical and procedural response. While the ultimate goal of a pentest is to find weaknesses, the primary duty of an ethical hacker is to ensure the safety and security of the client’s environment. Therefore, when a critical flaw is identified, the tester must immediately inform the relevant stakeholders or technical teams so that a prompt solution or "hotfix" can be implemented.

This immediate reporting deviates from the standard "end-of-test" report delivery because critical vulnerabilities represent an "active risk". If a tester finds an unpatched, high-impact vulnerability that is publicly known, there is a high probability that a real attacker could exploit it while the pentest is still ongoing. By notifying the client immediately, the tester helps mitigate the risk of an actual breach occurring during the assessment. This process is often detailed in the "Rules of Engagement" (RoE) agreed upon before the test begins.

Once the "corresponding area" (such as the DevOps or Security Operations team) is informed, the tester documents the vulnerability with clear reproduction steps and remediation advice. The tester may then be asked to "re-test" the vulnerability after the fix has been applied to verify its effectiveness. This highlights the collaborative nature of ethical hacking; it is not just about "breaking in" (Option B), but about the strategic management of risk. Professionalism in pentesting is defined by this commitment to communication and the proactive protection of the client's assets, ensuring that vulnerabilities are closed as quickly as possible to minimize the window of opportunity for malicious actors.

Ethical responsibility in hacking refers to the obligation to perform all security testing activitieslegally, transparently, and with explicit authorization, making option B the correct answer. Ethical hacking is not defined solely by technical skill, but by adherence to legal boundaries, professional conduct, and organizational policies.

Ethical hackers must always obtainwritten permissionbefore conducting reconnaissance, scanning, or exploitation activities. This authorization clearly defines the scope, targets, and limitations of the engagement. Without permission, even basic scanning activities may be considered illegal or unethical, regardless of intent.

Option A is incorrect because technical knowledge alone does not make hacking ethical. Skills must be applied responsibly. Option C is incorrect because performing scans without permission is a violation of ethical and legal standards and may result in criminal charges.

From an ethical hacking perspective, responsibility also includes responsible disclosure, minimizing impact, protecting sensitive data, and reporting findings accurately. Ethical hackers must avoid data misuse, service disruption, or unnecessary system damage.

Understanding ethical responsibility is foundational to professional cybersecurity practice. It distinguishes ethical hackers from malicious actors and ensures that security testing contributes positively to risk reduction, compliance, and organizational trust.

Google Dorking, also known as Google Hacking, is a passive reconnaissance technique that involves using advanced search operators to filter through the vast index of the Google search engine. It is important to clarify that Google Dorks do not "hack" computers or websites themselves; rather, they utilize the search engine's indexing power to find information that has already been made public—often inadvertently. By using specific strings like filetype:log, intitle:"index of", or inurl:admin, a researcher can locate sensitive directories, exposed log files, or configuration pages that were never intended to be indexed by search bots.

From a threat management perspective, Google Dorking is a double-edged sword. Ethical hackers use it during the information-gathering phase of a penetration test to see what an organization is leaking to the public web. This might include SQL error messages, which can reveal database structures, or publicly accessible backup files containing sensitive credentials. However, the tool itself is not a "backdoor" or an exploit; it is a sophisticated way of querying a database of cached website content.

If a computer or server appears in a Google Dork result, it typically means the administrator failed to configure the robots.txt file or server permissions correctly, allowing Google’s crawlers to document the internal structure. Managing this threat involves regular "dorking" of one's own domain to ensure that no sensitive paths or files are visible to the public. Understanding that Google Dorks are simply advanced search queries helps security professionals realize that the "leak" occurs at the server configuration level, not within the search engine itself. Consequently, remediation focuses on tightening access controls and ensuring that internal-only resources are not reachable or indexable by external search engines.

A reverse shell is a fundamental technique used during the "Gaining Access" and "Maintaining Access" phases of a penetration test. In a standard (bind) shell, the attacker connects to a specific port on the victim's machine to gain command-line access. However, most modern firewalls block incoming connections to unauthorized ports. To bypass this, a reverse shell reverses the connection logic: the victim's machine is tricked into initiating anoutgoingconnection to the attacker's machine, which is "listening" for the call.

This technique is highly effective because firewalls are typically much more permissive with "egress" (outgoing) traffic than with "ingress" (incoming) traffic. For example, an attacker might host a listener on port 443 (HTTPS). Since most organizations allow internal machines to browse the web over port 443, the firewall perceives the reverse shell connection as standard web traffic and allows it to pass. Once the connection is established, the attacker has a terminal interface on the victim's machine, allowing them to execute commands remotely.

In professional pentesting, establishing a reverse shell is often the primary goal of an exploit. It provides the "foothold" needed for lateral movement and privilege escalation. Common tools used to create reverse shells include Netcat (nc), Bash, and Python scripts. To defend against this, organizations must implement "Egress Filtering," which restricts outgoing traffic to only known, necessary destinations. Security professionals also monitor for "long-lived" connections to unusual IP addresses, as these can be a tell-tale sign of an active reverse shell. Understanding how these connections manipulate network policy is crucial for any ethical hacker seeking to demonstrate how internal systems can be compromised despite robust perimeter defenses.

Malware, short for "malicious software," is a broad category of software specifically engineered to perform unauthorized and often harmful actions on a computer system, network, or device. Its primary characteristic is that it operateswithout the owner's consent. Malware is the primary tool used by cybercriminals to achieve various objectives, ranging from financial gain to corporate espionage and simple disruption.

Malware encompasses several distinct types, each with its own method of infection and goal:

Viruses and Worms: Designed to spread from one file or computer to another, often damaging data or consuming network bandwidth along the way.

Trojan Horses: Programs that disguise themselves as legitimate software to trick users into installing them, only to reveal a malicious "payload" once active.

Ransomware: Encrypts the victim's data and demands payment for the decryption key.

Spyware and Stealers: Secretly monitor user activity or steal sensitive information like passwords and credit card numbers.

Rootkits: Specialized malware designed to provide high-level "root" access while remaining hidden from the operating system and antivirus software.

Ethical hackers study malware to understand how to defend against it. This involves analyzing "Attack Vectors" (how malware enters a system), "Persistence Mechanisms" (how it stays there), and "Command and Control" (how it communicates with the attacker). Protecting against malware requires a multi-layered defense strategy, including updated antivirus software, strictAcceptable Use Policies (AUP), and regular vulnerability scanning to close the gaps that malware exploits to infect systems.