Penetration Testing Essential Concepts CPENT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is in the final phase of an engagement. The client has asked for a meeting to discuss the findings and the next steps. The tester has already delivered the final report. What is the most important activity for the tester to perform during this meeting?

   • APresent a detailed technical walkthrough of every vulnerability found
   • BHand over all raw testing data and logs to the client
   • CDiscuss the business impact of the findings and prioritize remediation efforts
   • DNegotiate a new contract for a follow-up penetration test
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which component is typically included in the rules of engagement?

   • AThe full source code of the target application
   • BThe tester's personal contact information
   • CThe specific IP addresses and domains that are in scope
   • DThe list of all tools that will be used
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has been asked to assess the security of a new web application before it goes live. The team has a limited budget and needs to identify common vulnerabilities such as SQL injection and cross-site scripting. They decide to use an automated web application scanner. After the scan, they manually review the findings to confirm the vulnerabilities. They do not attempt to exploit the vulnerabilities to gain access to the server. What is the primary goal of this assessment?

   • ATo demonstrate the business impact of the vulnerabilities by exploiting them
   • BTo test the incident response capabilities of the security team
   • CTo provide a comprehensive risk assessment of the application's security posture
   • DTo identify and verify the presence of known vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is engaged to test a client's network. The rules of engagement specify that testing is allowed only between 2:00 AM and 6:00 AM to avoid impacting production. However, the tester discovers that the most critical vulnerability can only be validated during business hours when the application is under load. What should the tester do?

   • ATest during business hours because the vulnerability is critical
   • BSkip the validation and report the vulnerability as unconfirmed
   • CRequest a change to the rules of engagement to allow a brief, controlled test during business hours
   • DTest during business hours but use non-intrusive techniques to minimize impact
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security manager at a mid-sized company wants to understand whether their newly deployed web application is vulnerable to a specific critical CVE. They have a limited budget and need a definitive answer about exploitability, not just a list of potential issues. The manager hires a consultant who will use automated scanners to identify missing patches and then manually attempt to chain the discovered flaws to demonstrate business impact. What type of assessment is the consultant performing?

   • AVulnerability assessment, because the primary goal is to identify and report missing patches
   • BRisk assessment, because the goal is to quantify the likelihood and impact of threats
   • CPenetration testing, because the consultant is actively exploiting vulnerabilities to demonstrate business impact
   • DSecurity audit, because the focus is on compliance with internal security policies
   Reveal Solution Discussion Select an answer first