Check Point 156-401 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-401
- Exam Name: Hacking 101 Check Point Certified PenTesting Associate (CCPA)
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #111
What is NOT a key concept of ethical hacking?
- A . Authorization
- B . Confidentiality
- C . Notification of clients
- D . Exploiting systems for financial gain
Correct Answer: D
D
Explanation:
Ethical hacking is performed with permission and aims to protect client assets, not exploit them for personal gain.
D
Explanation:
Ethical hacking is performed with permission and aims to protect client assets, not exploit them for personal gain.
Question #112
Which tool helps footprint an organization by extracting email addresses?
- A . Burp Suite
- B . Wireshark
- C . theHarvester
- D . Hydra
Correct Answer: C
C
Explanation:
theHarvester gathers emails, domains, and hostnames from public sources, aiding in organizational foot printing .
C
Explanation:
theHarvester gathers emails, domains, and hostnames from public sources, aiding in organizational foot printing .
Question #113
Which tool is best suited for vulnerability scanning?
- A . Burp Suite
- B . Nmap
- C . OpenVAS
- D . Wireshark
Correct Answer: C
C
Explanation:
OpenVAS is a popular open-source tool specifically designed for comprehensive vulnerability scanning across networks and systems.
C
Explanation:
OpenVAS is a popular open-source tool specifically designed for comprehensive vulnerability scanning across networks and systems.
Question #114
A successful port scan reveals port 22 is open.
Which service is likely running?
- A . HTTP
- B . FTP
- C . SSH
- D . DNS
Correct Answer: C
C
Explanation:
Port 22 is the default port for SSH (Secure Shell), often used for remote administration of systems.
C
Explanation:
Port 22 is the default port for SSH (Secure Shell), often used for remote administration of systems.
Question #115
Which technique is used to gather internal email addresses through social engineering?
- A . Phishing
- B . Port knocking
- C . Web scraping
- D . DNS poisoning
Correct Answer: A
A
Explanation:
Phishing attacks during reconnaissance aim to trick users into revealing internal email addresses or other sensitive information.
A
Explanation:
Phishing attacks during reconnaissance aim to trick users into revealing internal email addresses or other sensitive information.
Question #116
What is passive reconnaissance?
- A . Directly probing systems for vulnerabilities
- B . Gathering information without direct interaction
- C . Launching exploits against discovered services
- D . Cracking passwords remotely
Correct Answer: B
B
Explanation:
Passive reconnaissance involves collecting information about a target without any direct engagement, keeping the process undetectable.
B
Explanation:
Passive reconnaissance involves collecting information about a target without any direct engagement, keeping the process undetectable.
Question #117
Which two tools are commonly used for passive footprinting? (Choose two.)
- A . Whois
- B . Netcat
- C . Nslookup
- D . Metasploit
Correct Answer: A, C
A, C
Explanation:
Whois and Nslookup are passive tools used to gather information like domain registration and DNS records without alerting the target.
A, C
Explanation:
Whois and Nslookup are passive tools used to gather information like domain registration and DNS records without alerting the target.
Question #118
What is the final phase in the penetration testing methodology?
- A . Exploitation
- B . Reporting
- C . Gaining Access
- D . Scanning
Correct Answer: B
B
Explanation:
Reporting is the last phase, where all findings are compiled into a detailed report for the client.
B
Explanation:
Reporting is the last phase, where all findings are compiled into a detailed report for the client.
Question #119
Which two tools are commonly used during the exploitation phase? (Choose two.)
- A . Metasploit
- B . Nessus
- C . John the Ripper
- D . Nikto
Correct Answer: A, C
A, C
Explanation:
Metasploit facilitates exploits, and John the Ripper is used for password cracking during or after successful exploitation.
A, C
Explanation:
Metasploit facilitates exploits, and John the Ripper is used for password cracking during or after successful exploitation.
Question #120
What type of reconnaissance is phishing considered?
- A . Passive
- B . Active
- C . Covert
- D . Direct
Correct Answer: B
B
Explanation:
Phishing requires direct interaction with the target, making it an active reconnaissance method.
B
Explanation:
Phishing requires direct interaction with the target, making it an active reconnaissance method.