Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A penetration tester has completed a test for a client and is preparing the final report. The client's executive team wants a high-level overview of the risks, while the IT team needs detailed technical findings and step-by-step remediation instructions. What is the most effective way to structure the report to meet both audiences' needs?

   • AProvide two separate reports: one for executives with only the executive summary, and one for IT with only the technical findings.
   • BProvide a single detailed technical report with all findings, risk ratings, and remediation steps, and let the executive team read the technical details.
   • CProvide a single executive summary that highlights the key risks and overall risk rating, and let the IT team request additional details if needed.
   • DProvide a report with an executive summary at the beginning, followed by detailed technical findings, risk ratings, and remediation recommendations.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of a penetration test?

   • ATo monitor network traffic in real time to detect and block ongoing attacks as they occur.
   • BTo scan systems for known vulnerabilities and generate a list of missing patches without attempting to exploit them.
   • CTo ensure that all security controls are configured according to industry best practices and compliance requirements.
   • DTo identify and exploit security vulnerabilities in a controlled manner to assess the security posture of a system or network.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security manager at a mid-sized company wants to understand the actual risk posed by a recently discovered vulnerability in a custom web application. The manager has already run an automated vulnerability scanner that identified the flaw and rated it as 'High' based on CVSS. The manager now asks a penetration tester to 'confirm the risk and provide actionable remediation steps.' What should the tester do to best meet this request?

   • ARun the same automated scanner again with a more aggressive scan profile to see if the CVSS score changes.
   • BPerform manual exploitation of the vulnerability to confirm it is exploitable, then assess the business impact and document the findings in a report with remediation steps.
   • CImmediately patch the vulnerability and then re-run the scanner to confirm the fix.
   • DReview the CVSS vector string and recalculate the score using a different scoring calculator to ensure accuracy.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is conducting an assessment and has just completed the reconnaissance phase. The tester has identified open ports and services on the target systems. According to standard penetration testing phases, what should the tester do next?

   • ABegin exploiting the identified services immediately.
   • BPerform vulnerability scanning and analysis on the identified services.
   • CWrite the final report based on the reconnaissance findings.
   • DObtain written authorization from the client before continuing.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A penetration tester is conducting a test for a client. During the post-exploitation phase, the tester gains access to a database containing sensitive customer data. The client's rules of engagement state that the tester must not exfiltrate data. The tester wants to prove the impact of the finding without violating the rules. What should the tester do?

   • AAsk the client for permission to exfiltrate a small sample of data.
   • BExfiltrate a small sample of data to prove the impact, and document it in the report.
   • CDocument the access and the potential impact in the report without exfiltrating any data.
   • DTake a screenshot of the database contents and include it in the report.
   Reveal Solution Discussion Select an answer first