Scribd Logo
Upload

Welcome to Scribd!

  • 199 views

    Answers To Ethical Hacker Interview Questions

    Uploaded by

    tsultim bhutia
    An ethical hacker interview candidate was asked various questions about ethical hacking techniques and tools. The questions covered topics such as the advantages and disadvantages of hacking, asymmetric vs symmetric encryption, denial of service attacks, footprinting, network enumeration, pharming, Cowpatty, vulnerability assessment vs penetration testing, data leakage detection and prevention, the hacking process, and common hacking tools. The candidate was also asked to explain concepts like encryption vs hashing, the CIA triangle, firewalls, and MAC flooding.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    Answers To Ethical Hacker Interview Questions

    Uploaded by

    tsultim bhutia
    199 views5 pages
    An ethical hacker interview candidate was asked various questions about ethical hacking techniques and tools. The questions covered topics such as the advantages and disadvantages of hacking, asymmetric vs symmetric encryption, denial of service attacks, footprinting, network enumeration, pharming, Cowpatty, vulnerability assessment vs penetration testing, data leakage detection and prevention, the hacking process, and common hacking tools. The candidate was also asked to explain concepts like encryption vs hashing, the CIA triangle, firewalls, and MAC flooding.

    Original Description:

    Ethical Hacker

    Original Title

    Answers to Ethical Hacker Interview Questions

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    An ethical hacker interview candidate was asked various questions about ethical hacking techniques and tools. The questions covered topics such as the advantages and disadvantages of hacking, asymmetric vs symmetric encryption, denial of service attacks, footprinting, network enumeration, pharming, Cowpatty, vulnerability assessment vs penetration testing, data leakage detection and prevention, the hacking process, and common hacking tools. The candidate was also asked to explain concepts like encryption vs hashing, the CIA triangle, firewalls, and MAC flooding.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    199 views5 pages

    Answers To Ethical Hacker Interview Questions

    Uploaded by

    tsultim bhutia
    An ethical hacker interview candidate was asked various questions about ethical hacking techniques and tools. The questions covered topics such as the advantages and disadvantages of hacking, asymmetric vs symmetric encryption, denial of service attacks, footprinting, network enumeration, pharming, Cowpatty, vulnerability assessment vs penetration testing, data leakage detection and prevention, the hacking process, and common hacking tools. The candidate was also asked to explain concepts like encryption vs hashing, the CIA triangle, firewalls, and MAC flooding.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 5
    At a glance
    Powered by AI
    Some of the key takeaways from the document include ethical hacking techniques like footprinting, network scanning, vulnerabilities identification and ways to secure networks from attacks.

    Advantages of hacking include finding security loopholes to prevent attacks while disadvantages include creating security issues and unauthorized access.

    Asymmetric encryption uses different keys for encryption and decryption while symmetric encryption uses the same key for both. Asymmetric is more secure but slower.

    Top Answers to Ethical Hacker Interview Questions

    1. What are the advantages and disadvantages of hacking?


    Advantages Disadvantages
    It can be used to foil security attacks It creates massive security issues
    To plug the bugs and loopholes Get unauthorized system access
    It helps to prevent data theft Stealing private information
    Hacking prevents malicious attacks Violating privacy regulations
    2. What is the difference between Asymmetric and Symmetric encryption?
    Asymmetric encryption Symmetric encryption
    Asymmetric encryption uses different keys for encryption and decryption.
    Symmetric encryption uses the same key for both encryption and decryption.
    Asymmetric on the other hand is more secure but slow. Hence, a hybrid approach
    should be preferred. Symmetric is usually much faster but the key needs to be
    transferred over an unencrypted channel.
    Check out this video on Ethical Hacker

    Learn for free ! Subscribe to our youtube Channel.

    3. How can you avoid ARP poisoning?


    ARP poisoning is a type of network attack that can be resolved through these
    techniques:

    Using Packet filtering: Packet filters can filter out & block packets with clashing
    source address data.

    Keeping away from trust relationship: Organizations ought to develop a protocol


    that depends on trust relationship as little as they can.

    Utilize ARP spoofing software: Some programs assess and certify information before
    it is transmitted and blocks any information that is spoofed.

    4. What do you understand by footprinting in ethical hacking? What are the


    techniques utilized for foot printing?
    Footprinting is nothing but accumulating and revealing as much as data about the
    target network before gaining access into any network.

    Open Source Footprinting : It will search for the contact data of administrators
    that will be utilized for guessing password in Social Engineering

    Network Enumeration : The hacker attempts to distinguish the domain names and the
    network blocks of the target network

    Scanning : After the network is known, the second step is to spy the active IP
    addresses on the network. For distinguishing active IP addresses (ICMP) Internet
    Control Message Protocol is a functioning IP addresses

    Stack Fingerprinting : the final stage of foot printing step can be performed, once
    the hosts and port have been mapped by examining the network, this is called Stack
    fingerprinting.

    5. What do you mean by DOS (Denial of administration) assault? Explain. What are
    the regular types of DOS assault?
    Denial of Service, is a malicious attack on network that is executed by flooding
    the system with useless traffic. Despite the fact that DOS does not cause any data
    breach or security breach, it can cost the site proprietor a lot of cash and time.

    Buffer Overflow Attacks


    SYN Attack
    Teardrop Attack
    Smurf Attack
    Viruses
    6. What is Pharming and Defacement?
    Pharming : In this strategy the attacker compromises the DNS (Domain Name System)
    servers or on the user PC with the goal that traffic is directed towards malicious
    site

    Defacement : In this strategy the attacker replaces the firm�s site with an
    alternate page. It contains the hacker�s name, images and may even incorporate
    messages and background music.

    7. What is Cowpatty?
    Cowpattyis implemented on an offline dictionary attack against WPA/WPA2 networks
    utilizing PSK-based verification (e.g. WPA-Personal). Cowpatty can execute an
    enhanced attack if a recomputed PMK document is accessible for the SSID that is
    being assessed.

    8. What is Network Enumeration?


    Network Enumeration is the revelation of hosts/gadgets on a network, they tend to
    utilize obvious disclosure protocols, for example, ICMP and SNMP to gather data,
    they may likewise check different ports on remote hosts for looking for surely
    known services trying to further recognize the function of a remote host.

    Want to learn more check out this Ethical Hacking Tutorial.

    9. Distinguish between phishing and spoofing?


    Phishing and spoofing are totally different beneath the surface. One downloads
    malware to your PC or network, and the other part tricks you into surrendering
    sensitive monetary data to a cyber-crook. Phishing is a technique for recovery,
    while spoofing is a method for delivery.

    10. Why is Python utilized for hacking?


    Most broadly utilized scripting language for Hackers is Python. Python has some
    very critical highlights that make it especially valuable for hacking, most
    importantly, it has some pre-assembled libraries that give some intense
    functionality.

    11. What can an ethical hacker do?


    An ethical hacker is a computer system and networking master who systematically
    endeavours to infiltrate a PC framework or network for the benefit of its owners to
    find security vulnerabilities that a malicious hacker could potentially exploit.

    12. What is network sniffing?


    System sniffing includes utilizing sniffer tools that empower real- time monitoring
    and analysis of data streaming over PC systems. Sniffers can be utilized for
    various purposes, regardless of whether it�s to steal data or manage systems.

    Network sniffing is utilized for ethical and unethical purposes. System


    administrators utilize these as system monitoring and analysis tool to analyse and
    avoid network related issues, for example, traffic bottlenecks. Cyber criminals
    utilize these devices for untrustworthy purposes, for example, character
    usurpation, email, delicate information hijacking etc.

    13. What is the difference between encryption and hashing?


    Encryption Hashing
    Encryption is reversible Hashing is irreversible
    Encryption ensures confidentiality Hashing ensures Integrity
    14. What is CIA Triangle?
    Confidentiality : Keeping the information secret.
    Integrity : Keeping the information unaltered.
    Availability : Information is available to the authorised parties at all times.
    Go through this Ethical Hacker Training to learn more about RPA.

    15. What is the difference between VA and PT?


    Vulnerability Assessment Penetration testing
    Vulnerability Assessment is an approach used to find flaws in an
    application/network It is the practice of finding exploitable vulnerabilities
    like a real attacker will do
    It is like travelling on the surface It is digging for gold.
    16. What is a firewall?
    A firewall could be a device that allows/blocks traffic as per outlined set of
    rules. These are placed on the boundary of trusted and untrusted networks.

    17. What is data leakage? How will you detect and prevent it?
    Data leak is nothing but data knowledge getting out of the organization in an
    unauthorized manner. Data will get leaked through numerous ways in which � emails,
    prints, laptops obtaining lost, unauthorized transfer of data to public portals,
    removable drives, pictures etc. There are varied controls which may be placed to
    make sure that the info doesn�t get leaked, many controls will be limiting upload
    on web websites, following an internal encryption answer, limiting the emails to
    the interior network, restriction on printing confidential data etc.

    18. What are the hacking stages? Explain each stage.


    Hacking, or targeting on a machine, should have the following 5 phases :

    Surveillance : This is the principal stage where the hacker endeavours to gather as
    much data as possible about the target

    Scanning : This stage includes exploiting the data accumulated amid Surveillance
    stage and utilizing it to inspect the casualty. The hacker can utilize computerized
    devices amid the scanning stage which can incorporate port scanners, mappers and
    vulnerability scanners.

    Getting access : This is where the real hacking happens. The hacker attempts to
    exploit data found amid the surveillance and Scanning stage to get access.

    Access Maintenance : Once access is gained, hackers need to keep that access for
    future exploitation and assaults by securing their exclusive access with backdoors,
    rootkits and Trojans.

    Covering tracks : Once hackers have possessed the capacity to pick up and maintain
    access, they cover their tracks and to keep away from getting detected. This
    likewise enables them to proceed with the utilization of the hacked framework and
    keep themselves away from legitimate activities.

    19. What are the tools used for ethical hacking?


    There are several moral hacking tools out there within the marketing for different
    purposes, they are:

    NMAP � NMAP stands for Network plotter. It�s associate degree open source tool
    that�s used wide for network discovery and security auditing.
    Metasploit � Metasploit is one amongst the most powerful exploit tool to conduct
    basic penetration tests.
    Burp Suit � Burp Suite could be a widespread platform that�s widely used for
    playing security testing of internet applications.
    Angry IP Scanner � Angry information processing scanner could be a light-weight,
    cross-platform information processing address and port scanner.
    Cain & Abel � Cain & Abel is a password recovery tool for Microsoft operational
    Systems.
    Ettercap � Ettercap stands for local area network Capture. It is used for Man-in-
    the-Middle attack using a network security tool.
    20. What is MAC Flooding?
    MAC Flooding is a kind of a technique wherever the protection of given network
    switch is compromised. In MAC flooding the hacker floods the switch with sizable
    amounts of frames, than what a switch can handle. This makes switch behaving as a
    hub and transmits all packetsto all the ports existing. Taking the advantage of
    this the attacker can attempt to send his packet within the network to steal the
    sensitive information.

    21. Explain how you can stop your website getting hacked?
    By adapting following methodology you�ll be able to stop your web site from
    obtaining hacked

    Using Firewall : Firewall may be accustomed drop traffic from suspicious


    information processing address if attack may be an easy DOS
    Encrypting the Cookies : Cookie or Session poisoning may be prevented by encrypting
    the content of the cookies, associating cookies with the consumer information
    processing address and temporal arrangement out the cookies once it slow
    Validating and confirmative user input : This approach is prepared to stop the type
    tempering by confirmative and verifying the user input before processing it
    Header Sanitizing and validation : This technique is beneficial against cross
    website scripting or XSS, this method includes verifying and sanitizing headers,
    parameters passed via the address, type parameters and hidden values to cut back
    XSS attacks.
    22. What is Burp Suite? What are the tools does it contain?
    Burp Suite is an integrated platform used for attacking net applications. It
    contains all the tools a hacker would need for attacking any application. a number
    of these functionalities are

    Proxy
    Spider
    Scanner
    Intruder
    Repeater
    Decoder
    Comparer
    Sequencer
    23. What is SQL injection and its types?
    If the application doesn�t sanitize the user input then the SQL injection happens.
    Thus a malicious hacker would inject SQL question to gain unauthorized access and
    execute administration operations on the database. SQL injections may be classified
    as follows:

    Error-based SQL injection


    Blind SQL injection
    Time-based SQL injection
    24. What's a denial of service (DOS) attack and what are the common forms?
    DOS attacks involve flooding servers, systems or networks with traffic to cause
    over-consumption of victim resources. This makes it troublesome or not possible for
    legitimate users to access or use targeted sites.
    Common DOS attacks include:

    Buffer overflow attacks


    ICMP flood
    SYN flood
    Teardrop attack
    Smurf attack
    25. Which programming language is used for hacking?
    It�s best, actually, to master all 5 of Python, C/C++, Java, Perl, and LISP.
    Besides being the foremost vital hacking languages, they represent totally
    different approaches to programming, and each of it can educate you in valuable
    ways.

    26. What is meant by spoofing attack?


    A spoofing attack is when a malicious party impersonates another device or user on
    a network so as to launch attacks against network hosts, steal data, unfold malware
    or bypass access controls. Different Spoofing attacks are deployed by malicious
    parties to achieve this.

    27. What are the different types of spoofing?


    ARP Spoofing Attack.
    DNS Spoofing Attack.
    IP Spoofing Attack.
    28. What is active and passive reconnaissance?
    Passive reconnaissance is nothing but to gain info regarding targeted computers and
    networks while not actively participating with the systems. In active
    reconnaissance, in distinction, the attacker engages with the target system,
    usually conducting a port scan to find any open ports.

    29. Differentiate Between a MAC and an IP Address?


    All networks across devices are assigned a number which is unique, which is termed
    as MAC or Machine Access Control address. This address may be a personal mail box
    on the net. The network router identifies it. the amount may be modified
    anytime.All devices get their distinctive information processing address so they
    can be located easily on a given laptop and network. Whoever is aware of your
    distinctive information processing address will contact you through it.

    30. What is SSL and why is it not enough when it comes to encryption?
    SSL is identity verification, not hard encryption. it�s designed to be able to
    prove that the person you�re engaging on the other side is who they say they are.
    SSL and TLS are each used by almost everyone online, however because of this it is
    a huge target and is mainly attacked through its implementation (The Heartbleed bug
    for example) and its far-famed methodology.

    You might also like