Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company that processes credit card payments is required to conduct regular penetration tests to maintain compliance. The company's security team is unsure which standard mandates these tests and what the tests must cover. Which standard and testing requirement should the team follow?

   • ANIST SP 800-115, which requires quarterly penetration testing of all systems.
   • BPCI DSS, which requires regular penetration testing of the cardholder data environment and supporting systems.
   • COWASP, which requires annual penetration testing of all web applications.
   • DISO 27001, which requires penetration testing of all external systems annually.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is scoping a test for a client. The client wants to test a specific web application that is hosted on a shared server with other applications. The client is concerned about impacting the other applications on the server. What should the tester do to address this concern?

   • AExclude the web application from the scope and test only the network perimeter.
   • BPerform the test without documenting the scope to avoid restricting the tester's actions.
   • CDefine the scope to include only the specific web application and document the rules of engagement to avoid impacting other applications on the server.
   • DInclude the entire server in the scope to ensure the test is thorough.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has just completed a vulnerability scan that identified several critical vulnerabilities in its network. Management wants to know which vulnerabilities could actually be exploited by an attacker to gain access to sensitive data. What should the company do next?

   • APatch all identified vulnerabilities immediately without further testing.
   • BRun another vulnerability scan with a different tool to confirm the results.
   • CConduct a penetration test to validate and exploit the identified vulnerabilities.
   • DReview the scan report and assume all critical vulnerabilities are exploitable.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is conducting an assessment and has reached the post-exploitation phase. The tester has gained access to a domain controller and wants to demonstrate the potential business impact. The client's rules of engagement prohibit lateral movement to other business units. What should the tester do?

   • ALateral move to other business units to demonstrate the full impact.
   • BAsk for verbal permission to continue lateral movement during the test.
   • CStop the test immediately and report the access as a critical finding.
   • DDocument the access achieved and the potential impact without lateral movement.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which section of a penetration testing report typically includes the severity rating and detailed technical description of each vulnerability?

   • AExecutive Summary
   • BMethodology
   • CScope and Objectives
   • DFindings and Risk Ratings
   Reveal Solution Discussion Select an answer first