Skip to content
ScopefileGet the app

Technique fileIntro to ethical hacking

Ethical hacking vs penetration testing: where the line sits

Ethical hacking is the whole discipline of attacking systems with permission to make them safer; penetration testing is one scoped, time-boxed engagement inside it, with a contract, rules of engagement and a report at the end.

Exam
312-50
Domain
1 · Overview
Targets
8

Where the line actually sits

Every penetration test is ethical hacking. The reverse does not hold. A security engineer reviewing firewall rules, a researcher reporting through a bug bounty program and a red team running a months-long exercise all practice ethical hacking. Only some of that work is packaged as a pen test, with a target list, a start date, an end date and a deliverable.

Both rest on the same paperwork, and that paperwork is the part of the Introduction to Ethical Hacking module worth learning cold: the signed authorization, the scope statement and the rules of engagement. Learn the documents once and they carry over to every module that follows.

Skip the online debates over job titles such as pentester versus ethical hacker. They change nothing about how an engagement is run.

Discipline vs engagement

How ethical hacking and a penetration test differ
TraitEthical hackingPenetration test
What it is (differs)A profession and a mindsetA single project
Duration (differs)OngoingFixed window agreed in advance
Scope (differs)Whatever the role coversA written target list and exclusions
Written permissionAlwaysAlways
Output (differs)Varies by roleA formal report of findings and fixes
Typical forms (differs)Defensive programs, research, bug bountiesBlack, gray or white box test

Tinted rows marked ≠: the two differ.

Paperwork before the first packet

  • Written, signed authorization covering the systems in scope
  • An agreed list of allowed techniques, testing hours, contacts and what to do if something breaks
  • A scope statement naming the targets in and the targets out
  • A non-disclosure agreement covering what the tester will see
  • An agreed box type, so both sides know how much the tester is told up front
  • A data-handling plan: who receives findings, how evidence is stored and destroyed

Box types in one pass

Black box means the tester starts with no inside knowledge and the test mirrors an outside attacker. White box hands over architecture, source code or credentials, which buys depth and coverage in less time. Gray box is the middle setting.

A separate choice is whether staff are told the test is happening. That decision changes what the engagement can say about the organization's detection and response.

The report

A pen test ends in a document with a remediation path for every finding. A finding without a fix is half a deliverable. For how a pen test compares with a broader, lighter review, see vulnerability assessment vs penetration test.

Paperwork and box types

Some items name a document, others a test setup.

Answered 0/8Hits 0

T-01

Which of the following factors MOST distinguishes a penetration test from a cyber attack?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. AEncryption may appear in both attacks and tests, so it says nothing about whether the activity is legitimate.
  2. BCorrect: explicit, documented authorization from the system owner is what legally separates a penetration test from a criminal attack.
  3. CObfuscation is a technique both attackers and testers can use; it does not determine legitimacy.
  4. DIntent matters ethically, but good intentions without the owner's permission still make an intrusion unauthorized and illegal.
T-02

Which term describes an agreement that defines the scope and limitations of a penetration test?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. AAn acceptable use policy governs how employees may use company systems, not what an external tester is allowed to do.
  2. BCorrect: rules of engagement define the scope, targets, timing, permitted techniques and limits that the testing team must follow.
  3. CChain of custody documents who handled evidence and when, which matters in forensics rather than in scoping a test.
  4. DA service level agreement sets performance and availability commitments between provider and customer, not testing boundaries.
T-03

Which of the following actions is permissible for an ethical hacker to undertake BEFORE receiving explicit authorization to conduct a vulnerability assessment?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. ACorrect: scoping discussions about goals, targets and constraints happen before authorization and are needed to write the agreement itself.
  2. BExploiting vulnerabilities without written authorization is unauthorized access and is illegal, regardless of the tester's intent.
  3. CSocial engineering employees is an active test of the organization and requires explicit permission first.
  4. DScanning a client network actively touches its systems and must wait until written authorization defines the scope.
T-04

You are conducting an authorized penetration test for a financial services client. Mid-engagement, the client's project manager verbally requests that you expand testing to include a recently acquired subsidiary's payment processing systems. The subsidiary operates in a different regulatory jurisdiction. What should you do FIRST?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. AA project manager's verbal request does not grant legal authority over another entity's systems, so testing immediately risks unauthorized access.
  2. BDelegating the paperwork and relying on someone else's assurance leaves the tester without documented permission for the new scope.
  3. CCorrect: scope changes need updated written authorization from every owner involved, especially when another legal entity and jurisdiction are added.
  4. DAn email echoing a verbal request is not a signed scope amendment and does not establish the subsidiary's consent.
T-05

In the context of ethical hacking, which type of testing requires more intensive reconnaissance due to a lack of initial system knowledge?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. AWhite box testers receive full documentation and credentials, so they need the least reconnaissance.
  2. BUnit testing is a software development practice that checks individual code components, not a penetration testing approach.
  3. CGray box testers start with partial knowledge, such as user credentials, which reduces but does not eliminate reconnaissance.
  4. DCorrect: black box testers start with no internal knowledge, so they must discover the environment through extensive reconnaissance.
T-06

Which type of penetration testing simulates an attack by someone with limited but some insider knowledge?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. AWhite box testing gives the tester full knowledge of the environment, which is more than limited insider knowledge.
  2. BCorrect: gray box testing gives partial knowledge, such as a user account or network diagram, emulating an insider or a compromised user.
  3. CUnannounced testing describes whether staff are warned about the test, not how much the tester knows about the target.
  4. DBlack box testing gives no prior knowledge, emulating an outside attacker rather than someone with insider information.
T-07

Which section of an ethical hacker's final report is designed to provide nontechnical stakeholders a concise overview of the client's current cybersecurity status and compliance with industry regulations?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. ACorrect: the executive summary gives leadership a short, nontechnical view of overall risk posture, key findings and compliance status, without the technical detail.
  2. BThe technical analysis section explains findings in depth for engineers and administrators, so it is too detailed to serve nontechnical stakeholders.
  3. CDetailed attack vector descriptions document how each finding could be reached, which is material for technical teams rather than a concise overview for executives.
  4. DThe vulnerability assessment section lists and rates individual weaknesses, giving detailed results rather than the high-level summary that nontechnical readers need.
T-08

When a cybersecurity professional attempts to identify security flaws by simulating a real-life cyber-attack, what process are they engaging in?

Make the call. Every option has a note waiting here.

Notes on all 4 options
  1. ACorrect: penetration testing simulates real-world attacks under authorization to find and prove exploitable weaknesses.
  2. BCompliance testing checks controls against a standard or regulation, without necessarily emulating an attacker.
  3. CA security audit reviews policies, configurations and controls against criteria, usually without active exploitation.
  4. DRisk assessment identifies and prioritizes risks by likelihood and impact, rather than simulating an attack.

A pen test is a project with an end date. Ethical hacking is the job it belongs to.

Engagements in practice

Is CEH a penetration testing certification?

CEH spans the knowledge behind ethical hacking across recon, system, network, web, wireless, mobile, cloud and crypto topics. A pen test is one way that knowledge gets applied. If a hands-on pen-testing credential is the goal, compare options on the ethical hacking career path page.

Does a bug bounty count as authorization?

Only within the program's published rules. A bounty policy works as standing permission with its own scope; stepping outside it puts the researcher back in unauthorized territory.

Is a red team exercise the same as a pen test?

Related, but the goal differs. A pen test tries to find and prove as many weaknesses as it can in scope. A red team pursues a specific objective over a longer period and measures how well defenders detect and respond along the way.