Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a black-box penetration test, what level of knowledge does the tester have about the target environment?

   • AFull knowledge of the source code, architecture, and internal credentials.
   • BKnowledge of the network topology but not the application logic.
   • CNo prior knowledge of the internal structure, source code, or credentials; the tester operates like an external attacker.
   • DPartial knowledge, such as valid user credentials but no source code.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which standard or framework is commonly used to guide penetration testing requirements for organizations that handle credit card data?

   • AOWASP
   • BNIST SP 800-115
   • CISO 27001
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the key difference between a vulnerability assessment and a penetration test?

   • AA vulnerability assessment identifies and lists potential vulnerabilities, while a penetration test exploits them to determine real-world impact.
   • BA vulnerability assessment is always automated, while a penetration test is always manual.
   • CA vulnerability assessment focuses on network devices, while a penetration test focuses on web applications.
   • DA vulnerability assessment is performed by internal staff, while a penetration test must be performed by external consultants.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester is conducting a test for a client. During the reconnaissance phase, the tester discovers that the client's external firewall is misconfigured and allows inbound traffic on port 3389 (RDP). The tester wants to exploit this finding. According to the standard penetration testing methodology, what should the tester do next?

   • AStop the test and inform the client of the misconfiguration immediately.
   • BImmediately exploit the RDP service to gain access to the internal network.
   • CProceed to the scanning phase to identify the target system and any additional services or vulnerabilities before attempting exploitation.
   • DDocument the finding in the report and move to the next phase.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which phase of a penetration test involves gathering information about the target without actively engaging with the systems?

   • APost-exploitation
   • BReconnaissance
   • CScanning
   • DExploitation
   Reveal Solution Discussion Select an answer first