Penetration Testing Essential Concepts CPENT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which penetration testing framework provides a detailed methodology for conducting penetration tests, including pre-engagement interactions and reporting?

   • ANIST SP 800-115
   • BISO 27001
   • CPTES (Penetration Testing Execution Standard)
   • DOWASP Top 10
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm wants to verify that its newly deployed web application is resistant to exploitation by a motivated attacker, not just that known vulnerabilities are patched. The CISO asks for an assessment that simulates real-world attack techniques, including chaining multiple weaknesses to achieve unauthorized access. Which type of assessment should the penetration tester recommend?

   • AA penetration test that includes active exploitation and post-exploitation activities
   • BA source code review focused on identifying coding errors
   • CA configuration review of the web server and application settings
   • DA vulnerability scan using an automated scanner with authenticated credentials
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best defines penetration testing?

   • AA passive review of system configurations and patch levels without attempting to exploit any weaknesses.
   • BA process of installing security patches and updates to remediate known vulnerabilities.
   • CA simulated cyberattack against a system to identify exploitable vulnerabilities and assess security controls.
   • DA method of monitoring network traffic to detect ongoing intrusions and alert security teams.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement correctly differentiates a vulnerability assessment from a penetration test?

   • AA vulnerability assessment actively exploits weaknesses, while a penetration test only scans for them.
   • BBoth processes are identical in methodology but differ only in the tools used.
   • CA vulnerability assessment identifies and classifies vulnerabilities, while a penetration test attempts to exploit them to determine impact.
   • DA penetration test is always automated, while a vulnerability assessment requires manual effort.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the most critical ethical and legal requirement before starting any penetration test?

   • AInforming all employees about the test
   • BUsing only open-source tools
   • CEnsuring the test causes no disruption
   • DObtaining written authorization from the system owner
   Reveal Solution Discussion Select an answer first