Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is hired by a large enterprise to test a new internal application. The enterprise has provided the tester with the application's source code, architecture diagrams, and a test environment with sample data. However, the enterprise has a strict policy that no testing can be performed during business hours, and the test window is limited to a single weekend. The tester must decide on the testing approach to maximize coverage within the constraints. What should the tester do?

   • APerform a white-box test, but only during business hours, to ensure the test is thorough.
   • BPerform a black-box test, using automated scanners to identify as many vulnerabilities as possible within the limited window.
   • CPerform a white-box test, focusing on static analysis of the source code and manual code review, since the test window is limited.
   • DPerform a gray-box test, using the provided source code and diagrams to guide targeted dynamic testing during the weekend window.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of the executive summary in a penetration testing report?

   • ATo provide a high-level overview of the test results for non-technical stakeholders, highlighting key risks and recommendations.
   • BTo document the exact commands and tools used during the test.
   • CTo list every vulnerability found with detailed technical exploit steps.
   • DTo provide a step-by-step guide for remediating all identified vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which framework provides a comprehensive set of guidelines for conducting security assessments, including penetration testing, and is widely used in the US federal government?

   • AOWASP
   • BPCI DSS
   • CISSAF
   • DNIST SP 800-115
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is planning an assessment for a web application that handles payment card data. The client requires the testing process to align with a methodology that specifically addresses web application security and also helps meet PCI DSS requirements. Which methodology should the tester use as the primary guide?

   • AOSSTMM
   • BPTES
   • CISSAF
   • DOWASP Testing Guide
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational corporation must conduct penetration testing to satisfy both PCI DSS and ISO 27001 requirements. The company operates in multiple regions with different data protection laws. The testing team must ensure that the testing methodology and reporting align with all applicable standards while respecting legal constraints. What is the most important consideration when planning the testing program?

   • AFocus only on PCI DSS requirements and ignore ISO 27001.
   • BUse a single methodology that is accepted globally, such as OSSTMM.
   • CConduct the testing only in regions where it is legally permitted and skip others.
   • DDefine scope and rules of engagement that incorporate regional legal requirements and align with PCI DSS and ISO 27001.
   Reveal Solution Discussion Select an answer first