Penetration Testing Essential Concepts CPENT Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   What is the primary purpose of a penetration test?

   • ATo determine whether identified vulnerabilities can be exploited and to assess the effectiveness of security controls.
   • BTo prove that a system is secure by demonstrating that no attacks succeed.
   • CTo replace the need for regular vulnerability scanning and compliance audits.
   • DTo identify as many potential vulnerabilities as possible without causing disruption.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is clear documentation important in a penetration testing report?

   • AIt helps stakeholders understand the risks and make informed decisions about remediation.
   • BIt provides a legal defense if the tester is sued.
   • CIt ensures the report is long enough to justify the cost of the test.
   • DIt allows the tester to avoid explaining the findings in person.
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   A penetration tester is engaged to assess a client's environment. The rules of engagement specify a 5-day testing window, but the client's change management board requires a 48-hour notice before any active exploitation attempt. The tester discovers a critical vulnerability on day 2 that requires immediate exploitation to validate. The client's emergency contact is available but the change board meets only on Mondays. What is the most appropriate course of action?

   • AContact the emergency contact to request an expedited approval for the exploitation attempt
   • BSkip exploitation and report the vulnerability as unvalidated
   • CProceed with exploitation immediately because the vulnerability is critical
   • DWait until the next change board meeting to get approval, even if it means the test window expires
   Reveal Solution Discussion Select an answer first