CEH Practice Test

This is most closely associated with Broken Access Control because users are reaching data or functions they should not be able to access. OWASP identifies access control failures as one of the most critical web application risk categories.

Exposing detailed error pages or stack traces when a malformed request is sent constitutes an Information Disclosure vulnerability. These details can reveal internal directory structures, software versions, database structures, and programming language details, providing an attacker with valuable reconnaissance data for future targeted exploitation.

Patching remains central because many validated findings trace back to outdated or vulnerable software and firmware that must be corrected or mitigated. NIST SP 800-40 Rev. 3 is built around that ongoing patch-management responsibility.

The Mean Time to Remediate (MTTR) tracks how quickly an organization validates and patches discovered vulnerabilities. A decreasing MTTR for critical issues indicates that the security, operations, and development teams are coordinating effectively to close windows of exposure, which represents a real improvement in defensive resilience.

The safest step is to pause and get explicit clarification before touching the third-party asset. Staying inside authorized boundaries is a core ethical-hacking requirement, especially when ownership or contractual control is uncertain.

A high-quality report must be actionable. The most critical section for a systems administrator is the detailed remediation guidance, which should contain clear, structured instructions on how to patch the software, disable insecure settings, or apply recommended vendor workarounds.

Network scanning and discovery were skipped. EC-Council's scanning module specifically covers host discovery, port scanning, service discovery, and OS identification before deeper attack activity.

Security Misconfiguration is correct because That most strongly suggests Security Misconfiguration because the weakness comes from unsafe deployment or operational settings rather than from business logic or crypto itself. The cited source, OWASP Top Ten Web Application Security Risks, supports this answer for the Web Application Security scenario rather than the adjacent distractors.

CISA's Known Exploited Vulnerabilities Catalog is correct because CISA's Known Exploited Vulnerabilities Catalog is especially useful because it tracks vulnerabilities known to be exploited in the wild. The cited source, Known Exploited Vulnerabilities Catalog | CISA, supports this answer for the Vulnerability Analysis scenario rather than the adjacent distractors.

CISA's Known Exploited Vulnerabilities (KEV) catalog tracks vulnerabilities that have been verified as actively exploited in the wild. While a vulnerability might have a theoretical CVSS score of 10, if there is no active exploit or threat actor using it, the immediate likelihood of threat is lower than a CVSS 8.0 vulnerability that is actively being weaponized. Prioritizing KEV items helps teams address real-world, high-probability attacks first.