Introduction to Penetration Testing and Methodologies CPENT Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which statement best describes what a penetration test aims to achieve?

   • AIt verifies that all software is up to date with the latest security patches.
   • BIt provides a continuous, real-time analysis of security events to detect intrusions.
   • CIt demonstrates how an attacker could compromise a system and what business impact that could have.
   • DIt ensures that the organization complies with all relevant data protection regulations.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which type of penetration test is performed from outside the organization's network perimeter, simulating an attack from the internet?

   • AWhite-box penetration test
   • BExternal penetration test
   • CInternal penetration test
   • DGray-box penetration test
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company wants to test the security of its internal application from the perspective of an authenticated user with standard privileges. The testers will be given valid user credentials but no other internal knowledge. Which type of penetration test is being described?

   • AGray-box test
   • BWhite-box test
   • CBlack-box test
   • DExternal test
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company is required to comply with PCI DSS and must conduct regular penetration tests. The company's security team is planning the test and needs to choose a methodology that aligns with PCI DSS requirements. The team also needs to ensure the test covers the cardholder data environment. Which methodology and standard combination should the team use?

   • APTES and PCI DSS
   • BOWASP and ISO 27001
   • CISSAF and ISO 27001
   • DOSSTMM and NIST SP 800-115
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A penetration tester is engaged to test a client's external web application. The client has provided a detailed scope that includes the application's domain and IP addresses. However, during the reconnaissance phase, the tester discovers that the application is hosted on a shared server with several other applications. The client's scope does not mention the shared server. The tester wants to test the application thoroughly but is concerned about impacting the other applications. What should the tester do?

   • ATest the shared server but only for vulnerabilities that could affect the target application.
   • BStop the test and ask the client to expand the scope to include the shared server.
   • CTest only the target application and avoid any actions that could impact the shared server or other applications.
   • DTest the shared server and all applications on it to ensure the target application is thoroughly tested.
   Reveal Solution Discussion Select an answer first