Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of the pre-engagement phase in a penetration test?

   • ATo exploit identified vulnerabilities and gain access to the target.
   • BTo write the final report and present findings to management.
   • CTo actively scan the target network for open ports and services.
   • DTo define the scope, rules of engagement, and legal authorization for the test.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a mature security program and conducts regular vulnerability scans. Management is considering a penetration test but is unsure if it adds value beyond the scans. The company has a low tolerance for downtime and a limited budget. Which argument best justifies the value of a penetration test in this context?

   • AA penetration test is required by law for all companies.
   • BA penetration test validates whether vulnerabilities can be chained to achieve a business-impacting compromise.
   • CA penetration test eliminates all security risks.
   • DA penetration test is cheaper than a vulnerability scan.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is about to start an assessment for a client. The client has specified that the tester must not use social engineering and must not test the third-party payment gateway. The tester needs to document these constraints before starting. What is the most appropriate action?

   • AIgnore the constraints because they are not technically relevant to the test.
   • BInclude these constraints in the rules of engagement document and obtain client sign-off.
   • CAsk the client to provide a written list of prohibited activities after the test begins.
   • DProceed with the test and avoid social engineering and the payment gateway as instructed.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which penetration testing methodology is specifically focused on web application security and is widely used for testing web applications?

   • APTES
   • BOWASP
   • CISSAF
   • DOSSTMM
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration testing team is planning a test for a web application that handles online payments. The team needs to choose a methodology that provides detailed, step-by-step testing procedures specifically for web application security, including testing for injection, broken authentication, and security misconfigurations. The team also needs to align with a widely recognized industry standard. Which methodology and standard combination should the team use?

   • APTES and NIST SP 800-115
   • BISSAF and ISO 27001
   • COWASP and PCI DSS
   • DOSSTMM and ISO 27001
   Reveal Solution Discussion Select an answer first