Cyber Security Quiz: Security Testing Ethics
10 questions · exam conditions
0:00
Security Testing EthicsQuestion 1 of 10

During an authorized production application test, a tester discovers that changing a numeric object identifier exposes customer tax records. The tester has already viewed one record belonging to the designated test account and one record belonging to an unrelated customer.

Which next step best balances validation of the vulnerability with ethical data handling?

Enumerate additional identifiers until the tester can estimate the total number of exposed customers.
Stop accessing records, preserve minimal evidence, and report the confirmed cross-account exposure securely.
Download several records in encrypted form so the client can independently reproduce the finding.
Delete the unrelated customer's record from local logs and continue testing with random identifiers.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Security Testing Ethics

Practice Security Testing Ethics in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Security Testing Ethics, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

During an authorized production application test, a tester discovers that changing a numeric object identifier exposes customer tax records. The tester has already viewed one record belonging to the designated test account and one record belonging to an unrelated customer.

Which next step best balances validation of the vulnerability with ethical data handling?

  1. Enumerate additional identifiers until the tester can estimate the total number of exposed customers.
  2. Stop accessing records, preserve minimal evidence, and report the confirmed cross-account exposure securely. (correct answer)
  3. Download several records in encrypted form so the client can independently reproduce the finding.
  4. Delete the unrelated customer's record from local logs and continue testing with random identifiers.
Explanation: When you encounter penetration testing ethics questions, anchor your thinking to two principles: minimize harm to third parties and stop at proof-of-concept. The moment you've confirmed a vulnerability, additional exploitation serves no legitimate testing purpose — it only compounds the privacy violation. Here, the tester already has everything needed: a confirmed instance of Insecure Direct Object Reference (IDOR) affecting real customer data. That one unintentionally accessed record is already a significant finding. The ethical obligation at that point is to stop, document the minimal evidence that proves the vulnerability exists, and report it through a secure channel so the client can scope the full impact themselves. B is correct because it satisfies all three ethical obligations simultaneously — ceasing unauthorized data exposure, preserving just enough evidence to prove the finding, and reporting responsibly. The client's security team, not the tester, is the appropriate party to enumerate affected records under controlled conditions. A is the most tempting distractor, but enumerating additional identifiers to "estimate" exposure means deliberately accessing more real customer records. Good intentions don't justify escalating a privacy violation — scope the damage through reporting, not further exploitation. C sounds responsible because encryption is involved, but downloading multiple customer records — even encrypted — still constitutes unauthorized data collection and creates a data-handling liability for both tester and client. Encryption protects data in transit, not your ethical standing. D is doubly problematic: deleting evidence tampers with audit trails (potentially illegal), and "continue testing with random identifiers" simply restarts the same harmful behavior. Study tip: On security exams, when a question asks what to do after confirming a vulnerability, the right answer almost always stops short of further exploitation. "Prove it once, report it fully" is the golden rule.

Question 2

A penetration test's signed rules of engagement explicitly exclude social engineering. Midway through the test, the client's IT manager verbally asks the lead tester to make several phishing calls because the manager wants quick evidence for an upcoming meeting.

What should the lead tester do before making the calls?

  1. Proceed because an IT manager's verbal request supersedes the original testing restriction.
  2. Obtain a written scope amendment from an authorized party with defined safeguards and targets. (correct answer)
  3. Call only employees whose contact details are already publicly available on the company website.
  4. Make the calls without collecting credentials so the activity remains an awareness exercise.
Explanation: Penetration testing questions often hinge on a single principle: scope changes require formal authorization. When you see a scenario where someone verbally requests out-of-scope activity, your first instinct should be to ask, "Is this request properly documented and authorized?" A signed rules of engagement (ROE) document is a legal contract. It defines what testers are permitted to do, protects them from liability, and ensures the client organization has formally accepted the risk. Social engineering — including phishing calls — carries significant legal, reputational, and ethical risk, which is precisely why it requires explicit written consent with defined parameters (specific targets, timeframes, and safeguards like a "get out of jail free" letter). B is correct because it reflects this standard: before expanding scope, you must obtain a written amendment from someone with actual authority to authorize it, along with clearly defined targets and protective measures. An IT manager making a hallway request doesn't constitute proper authorization. A is wrong because verbal requests never supersede written agreements, regardless of the requester's title. An IT manager may not even have authority to modify a signed contract — that typically requires executive or legal sign-off. C is wrong because limiting calls to publicly available contacts doesn't resolve the core problem: the activity is still out of scope and unauthorized. D is wrong because omitting credential collection doesn't make unauthorized social engineering acceptable — the legal and ethical violation lies in conducting the activity at all, not in what data you collect. Study tip: On security certification exams, any scenario involving scope expansion should trigger the phrase "written, authorized amendment." Verbal approval is never enough.

Question 3

An assessor has authorization to validate a suspected remote command execution flaw on a production server. The rules permit exploitation when necessary but prohibit persistence, service disruption, and access to business data. A harmless test account and a designated temporary directory are available.

Which validation method is most ethically proportionate?

  1. Execute a benign identity command and create a uniquely named file in the designated directory. (correct answer)
  2. Install a temporary remote-access agent and remove it immediately after confirming connectivity.
  3. Read a production database configuration file to demonstrate the privileges obtained by exploitation.
  4. Restart the affected service after exploitation to prove the assessor controls the server process.
Explanation: When evaluating penetration testing scenarios, your guiding principle should be minimal footprint — use only the access, tools, and techniques necessary to confirm the vulnerability exists, nothing more. Every action must stay within scope and cause no collateral impact. The most proportionate validation is A. Running a benign identity command (like whoami or id) confirms remote code execution is possible, while creating a uniquely named file in the designated temporary directory proves you can write to the filesystem. Together, these actions demonstrate the vulnerability's impact without touching business data, disrupting services, or leaving persistent artifacts — perfectly aligned with the stated rules. B is wrong because installing a remote-access agent — even temporarily — constitutes establishing persistence, which the rules explicitly prohibit. "I'll remove it afterward" doesn't justify creating the prohibited condition in the first place. The rules govern actions taken, not just end states. C directly violates the prohibition on accessing business data. Reading a database configuration file may seem like a clever way to prove privilege escalation, but it exposes sensitive production information. Demonstrating impact doesn't require actually harvesting protected data. D restarting the affected service is textbook service disruption, another explicitly prohibited action. Even if the restart is brief and intentional, any downtime on a production server harms real users and violates scope. Study tip: On ethical hacking and rules-of-engagement questions, treat each prohibited category (persistence, disruption, data access) as a hard disqualifier. If an answer touches any prohibited category — even partially or temporarily — eliminate it immediately. The correct answer will always be the one that proves the vulnerability with the least possible real-world consequence.

Question 4

A security assessor confirms that a critical internal control is ineffective. A senior client executive asks the assessor to downgrade the finding to medium severity because reporting a critical issue will delay a planned compliance attestation. The executive does not dispute the evidence or technical impact.

What is the most ethically appropriate response by the assessor?

  1. Downgrade the rating because organizational risk acceptance belongs exclusively to senior management.
  2. Remove the severity rating and let the executive describe the issue directly to the auditors.
  3. Publish the finding outside the organization if the executive refuses to retain the critical rating.
  4. Maintain an evidence-based assessment and document any formal management risk acceptance separately. (correct answer)
Explanation: When a question asks how a security assessor should respond to pressure that conflicts with professional integrity, you're being tested on the ethics of independent assessment — a core principle in frameworks like ISACA, NIST, and ISO 27001. The key tension here is between organizational convenience and the assessor's duty to report findings accurately and objectively. The right move is D: maintain the evidence-based critical rating and document any formal management risk acceptance separately. The executive doesn't dispute the evidence or technical impact — they simply want a more convenient label. An assessor's professional obligation is to report findings as the evidence supports them. If management chooses to accept the risk anyway, that decision can and should be documented as a formal risk acceptance, which is a legitimate governance mechanism. This preserves both the assessor's integrity and the organization's right to make informed business decisions. Choice A is wrong because risk acceptance by management is a response to a finding, not a justification for misrepresenting its severity in the first place. Senior executives can accept risk; they cannot ethically override technical evidence. Choice B compounds the problem — removing the severity rating doesn't make the finding more honest, it makes it more ambiguous. Letting executives describe findings to auditors themselves bypasses the assessor's independent role entirely, which undermines the purpose of the assessment. Choice C is a serious overreach. Publishing findings outside the organization without authorization could violate confidentiality agreements, legal obligations, and professional codes of conduct. Escalation within proper channels is appropriate; unilateral external disclosure is not. Your study tip: on ethics questions, watch for answer choices that confuse who has authority with who has accuracy. Management owns risk decisions, but the assessor owns the integrity of the findings.

Question 5

An authorized assessment covers a retailer's web application. Checkout redirects users to a payment page hosted by an external payment provider. The tester notices that the provider's page appears vulnerable to parameter manipulation, but the provider is not named in the rules of engagement.

What should the tester do?

  1. Test the provider because the retailer relies on the page as part of its checkout process.
  2. Test only with the retailer's payment account because no unrelated account would be affected.
  3. Avoid testing the provider and notify the retailer so separate authorization can be obtained. (correct answer)
  4. Send the suspected issue directly to the provider after confirming it with several transactions.
Explanation: Penetration testing questions like this one are really testing your understanding of scope and authorization — the foundational principle that you may only test systems explicitly covered by your rules of engagement (ROE). When you encounter a scenario where a vulnerability appears on a third-party or out-of-scope system, your ethical and legal obligations kick in immediately. The right move is C: stop, avoid testing the provider, and notify the retailer so they can pursue separate authorization with the payment provider. Even though the vulnerability affects the retailer's checkout flow, the provider is a distinct legal entity. Testing their infrastructure without explicit permission — even with good intentions — constitutes unauthorized access, which can carry serious legal consequences under laws like the Computer Fraud and Abuse Act (CFAA). A is tempting because the payment page is functionally part of the retailer's user experience, but functional dependency does not equal legal authorization. Scope is determined by the ROE document, not by how systems are connected. B introduces a dangerous rationalization — the idea that limiting your test to one account makes it acceptable. It doesn't. You're still interacting with an unauthorized system, regardless of which account you use. The harm isn't just to other users; it's to the provider's infrastructure itself. D is perhaps the most harmful option: confirming a vulnerability by executing multiple transactions means actively exploiting a live payment system without authorization, which is both illegal and potentially damaging. Your study tip: whenever a scenario introduces a third party or an out-of-scope asset, your answer will almost always involve stopping and escalating — never self-authorizing expanded scope.

Question 6

While testing an authorized source-code repository, an assessor follows a documented build link that unexpectedly opens a publicly accessible storage bucket. The bucket is outside the listed scope and contains credentials and employee documents.

What is the most appropriate handling of this accidental discovery?

  1. Record minimal location evidence, stop accessing the bucket, and report through the approved channel. (correct answer)
  2. Use one credential to confirm whether the exposed secrets still provide system access.
  3. Inventory the bucket contents to determine the severity before contacting the client.
  4. Move the documents into a private folder in the bucket to prevent further public access.
Explanation: When penetration testers stumble upon out-of-scope assets, the guiding principle is minimum necessary interaction — you gather just enough to document the issue and immediately escalate through proper channels. Think of it like a surgeon who nicks an unrelated organ: your job is to stop, note what happened, and alert the right people — not to explore further. Option A is correct because it honors this principle precisely. You record the location (the URL or bucket identifier) as evidence, cease all further access to avoid unauthorized activity, and report the finding through the pre-agreed channel. This protects both the client and the assessor legally, since continuing access to out-of-scope systems without authorization — even accidentally discovered — can void your authorization and expose you to liability. Option B is dangerous because using a discovered credential to test access is unauthorized exploitation, not documentation. Even with good intentions, you've now crossed into systems that were never part of your scope, which is illegal under frameworks like the CFAA. Option C sounds responsible but is actually a trap. "Inventorying" the bucket means continuing to access and enumerate sensitive data — employee documents and credentials — that you have no authorization to review. Severity is the client's call to make, not yours. Option D seems helpful but is critically wrong: modifying the bucket (even to protect data) constitutes unauthorized alteration of a client's system and could destroy forensic evidence or create new legal complications. Study tip: On security exams, questions about accidental discovery test whether you know that scope boundaries are absolute — good intentions never justify unauthorized access. Stop, document minimally, report immediately.

Question 7

A public bug-bounty program provides safe-harbor language for good-faith research. Its rules permit testing a specified API but prohibit denial-of-service techniques and automated requests exceeding 10 requests per second. A researcher believes a race condition can be demonstrated only by sending 200 requests per second.

Which course of action is ethically appropriate?

  1. Run the high-rate test because safe harbor protects any good-faith attempt to prove impact.
  2. Run the test briefly during off-peak hours and stop if service latency becomes noticeable.
  3. Distribute the requests across several addresses so each source remains below the stated limit.
  4. Request explicit permission or an approved test environment before exceeding the stated limit. (correct answer)
Explanation: When evaluating bug-bounty ethics questions, focus on one core principle: safe harbor protects good-faith research conducted within the program's defined scope — it does not grant permission to exceed explicitly stated rules. The moment you violate a program's stated limits, you've stepped outside safe harbor, regardless of your intentions. D is the ethically correct path because the program's rules are unambiguous — 10 requests per second is the ceiling. When your research methodology requires exceeding that ceiling, the appropriate move is to seek explicit written permission or request an isolated test environment. This protects both you and the program operator, keeps you within legal and ethical bounds, and demonstrates the professional conduct responsible disclosure requires. A is tempting but fundamentally wrong. "Good faith" doesn't override explicit prohibitions. Safe harbor language shields researchers who follow the rules; it doesn't function as a blanket immunity for any action labeled good-faith. Running 200 req/s violates the DoS-adjacent rate limit the program specifically set. B introduces a judgment-based threshold ("stop if latency becomes noticeable") that you cannot reliably control or predict. Causing any degradation — even briefly — likely constitutes the denial-of-service behavior the rules prohibit. "Off-peak" timing doesn't change the fundamental rule violation. C is particularly dangerous because distributing requests across multiple addresses to circumvent a per-source rate limit is deliberate evasion. This isn't a technicality — it's bad faith by definition, and many programs and computer fraud statutes treat deliberate circumvention of access controls as a serious violation. Study tip: On security ethics questions, always ask yourself whether the action requires violating an explicitly stated rule. If it does, the answer is always "get permission first" — not "find a creative workaround."

Question 8

A researcher privately reports a critical authentication bypass to a vendor and initially agrees to a 60-day coordinated disclosure period. On day 55, the vendor requests another 90 days. The researcher has credible evidence that attackers are now exploiting the flaw, while the vendor has published neither a patch nor temporary mitigation guidance.

Which response is most consistent with responsible disclosure?

  1. Grant the full extension because the vendor alone determines when vulnerability information may be released.
  2. Immediately publish complete exploit code so users can verify whether their systems are vulnerable.
  3. Reassess the timeline with the vendor and pursue prompt, mitigation-focused disclosure without enabling exploitation. (correct answer)
  4. Remain silent indefinitely because any disclosure before a patch would transfer risk to affected users.
Explanation: When a question involves vulnerability disclosure timelines, think about the competing obligations at play: protecting users from active harm, giving vendors fair opportunity to remediate, and avoiding actions that hand attackers a ready-made weapon. Responsible disclosure is a negotiated balance, not a rule that unconditionally favors either the researcher or the vendor. Here, the original 90-day extension request might be reasonable in isolation, but active exploitation changes everything. Once attackers are already using the flaw, the calculus shifts — continued silence no longer protects users, it abandons them. The ethical move is to renegotiate the timeline urgently and, if the vendor won't act, publish mitigation-focused information: enough for defenders to detect or block attacks without handing attackers a polished exploit. That's exactly what C describes. A is wrong because it inverts the power dynamic. Vendors do not have unilateral authority over disclosure; the researcher retains independent ethical obligations, especially when users face active harm. Granting any extension the vendor demands would make responsible disclosure meaningless. B is wrong because publishing complete exploit code turns the researcher into an enabler. Even if users could theoretically test their exposure, releasing weaponized code arms the very attackers already exploiting the flaw — causing net harm, not protection. D is wrong because indefinite silence is not neutrality. When exploitation is confirmed and no mitigation exists, staying quiet is a choice that actively leaves users undefended. Risk doesn't disappear by keeping secrets. A useful heuristic: active exploitation is a trigger condition that overrides extended timelines, but the response must still minimize attacker advantage — narrow disclosure, not a full exploit dump.

Question 9

A consultant discovers a serious vulnerability during a paid assessment. Before the client receives the report, the consultant considers buying put options against the client's publicly traded stock, believing the vulnerability will reduce the share price once it becomes known.

Which action best addresses the ethical issue?

  1. Make the trade after submitting the report, since the client will then hold the same information as the consultant.
  2. Avoid trading on the finding entirely, and comply with all confidentiality and conflict-of-interest obligations. (correct answer)
  3. Execute the trade through a managed account so the consultant does not personally place the order.
  4. Wait until the remediation deadline passes, then trade before initiating coordinated public disclosure.
Explanation: When a security consultant gains non-public information through a paid engagement, they enter territory governed by both professional ethics and securities law. Insider trading law prohibits trading on material, non-public information — and a serious vulnerability that could move a company's stock price absolutely qualifies as material. This question tests whether you recognize that ethical obligations don't dissolve just because someone finds a creative workaround. Option B is correct because it's the only choice that actually eliminates the conflict of interest. The consultant's duty is to the client: protect confidential findings, report them promptly, and never exploit privileged access for personal financial gain. Abstaining from any trade based on that information is the only path that honors both professional ethics standards (like those in the EC-Council or ISC² codes of conduct) and securities regulations. Option A fails because the timing of the trade doesn't neutralize the violation — the consultant still acted on non-public information before the market knew. Submitting the report doesn't make insider trading retroactively acceptable. Option C is a classic "laundering the action" trap: routing a trade through a managed account doesn't change the underlying intent or legality. You remain the beneficial party, and regulators look at who originated the decision, not who clicked the button. Option D is arguably the most dangerous distractor — waiting until a remediation deadline feels procedural and almost principled, but trading ahead of a planned public disclosure is still insider trading. Knowing the disclosure is coming is itself the material non-public information. The key pattern to remember: any variation of "trade later" or "trade indirectly" is still trading on inside information. Ethical compliance requires not trading at all, full stop.

Question 10

A company authorizes a penetration test of "all systems under example.com" for two weeks. During reconnaissance, the tester finds payroll.example.com, which is operated by a recently acquired subsidiary. The statement of work does not identify subsidiaries, and the acquired company has its own security management team.

What is the most ethically appropriate action before actively testing payroll.example.com?

  1. Proceed because the hostname is technically within the authorized example.com domain.
  2. Perform only non-destructive scans because they create little risk to the subsidiary.
  3. Obtain written clarification that the subsidiary system is included in the authorized scope. (correct answer)
  4. Ask the subsidiary administrator informally and proceed if that administrator gives verbal approval.
Explanation: Penetration testing questions like this one are really testing your understanding of scope authorization — one of the foundational ethical principles in offensive security work. Whenever a scenario involves a target that might be in scope but isn't explicitly confirmed, your instinct should be to pause and verify before touching anything. The key issue here is that "all systems under example.com" is ambiguous. Payroll.example.com belongs to a recently acquired subsidiary with its own security management. The original client may not have had authority to authorize testing of systems they don't directly control. Acting on an ambiguous authorization isn't just a procedural concern — it could expose you to legal liability and harm an organization that never consented. The only safe and ethical path is C: obtain written clarification from the authorizing party confirming the subsidiary is explicitly in scope before proceeding. A is tempting because the hostname technically falls under the domain, but technical inclusion doesn't equal legal or organizational authorization. Scope is defined by people and agreements, not DNS hierarchies. B introduces a common trap: the idea that "low-impact" actions are acceptable without proper authorization. Non-destructive doesn't mean authorized — even a port scan without permission can constitute unauthorized access under laws like the CFAA. D sounds reasonable but fails because verbal approval from a subsidiary admin isn't the same as written authorization from the entity that contracted the test. Informal approval doesn't protect you legally and bypasses the formal chain of authority entirely. Your study tip: on penetration testing ethics questions, always ask who has the authority to authorize this, and remember that written authorization is non-negotiable — not optional.