Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to assess the security of its internal network from the perspective of an external attacker who has no prior knowledge of the infrastructure. The assessment must also avoid disrupting business operations during peak hours. Which type of penetration test and scheduling approach is most appropriate?

   • AGray-box test conducted during business hours with partial credentials provided to the testers.
   • BWhite-box test conducted during business hours with full network diagrams provided to the testers.
   • CInternal test conducted from inside the network with a standard user account.
   • DBlack-box test conducted during off-peak hours with no internal information provided to the testers.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial institution is required to undergo regular penetration testing as part of its PCI DSS compliance. The institution also wants to align its testing with industry-recognized best practices. Which combination of framework and standard should the institution reference when planning its testing program?

   • APCI DSS and OWASP Testing Guide
   • BNIST SP 800-115 and ISSAF
   • CISO 27001 and OSSTMM
   • DPTES and ISO 27001
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration testing team is selecting a methodology for a comprehensive network and application assessment. The client requires a methodology that covers the entire testing process from pre-engagement to reporting and is vendor-neutral. Which methodology is most appropriate?

   • APCI DSS
   • BISSAF
   • COWASP Testing Guide
   • DPTES
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration testing team is preparing to test a client's infrastructure. The team needs to select a methodology that provides a structured approach to testing, including specific deliverables and reporting requirements. The client also requires the test to align with a standard that is widely recognized for security testing. Which methodology and standard combination best fits this requirement?

   • AOSSTMM and NIST SP 800-115
   • BPTES and NIST SP 800-115
   • CPTES and ISO 27001
   • DISSAF and PCI DSS
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has just experienced a security breach. The company's management wants to understand how the breach occurred and what vulnerabilities were exploited. The company has a limited budget and needs to act quickly. Should the company hire a penetration tester or a vulnerability assessor?

   • AHire both a vulnerability assessor and a penetration tester to ensure a thorough investigation.
   • BHire a penetration tester to simulate the attack and determine how the breach occurred.
   • CHire a security auditor to review the company's security policies and procedures.
   • DHire a vulnerability assessor to scan the network and identify all vulnerabilities that could have been exploited.
   Reveal Solution Discussion Select an answer first