Penetration Testing Essential Concepts CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which testing approach provides the tester with full knowledge of the target environment, including source code and architecture?

   • AGray-box testing
   • BWhite-box testing
   • CBlack-box testing
   • DExternal testing
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a mature security program and runs regular vulnerability scans. The CISO wants to understand whether the identified vulnerabilities are actually exploitable and what the business impact would be. The company has a limited budget and cannot afford both a full penetration test and a separate vulnerability assessment. What should the security team recommend?

   • AContinue with vulnerability scans only, as they already identify risks
   • BPerform a penetration test that includes a vulnerability assessment phase
   • CHire a third-party to do a one-time vulnerability scan and compare results
   • DPurchase a more expensive vulnerability scanner with higher accuracy
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A penetration tester is hired to assess the security of a client's external network. The client has provided a detailed rules of engagement document that specifies the exact IP ranges to test and the testing windows. During the test, the tester discovers a critical vulnerability on a server that is outside the specified IP range but is owned by the same client. The vulnerability could allow an attacker to access the internal network. The client's primary objective is to identify risks to the internal network. What is the most appropriate action for the tester to take?

   • ATest the out-of-scope server because it is owned by the client and the vulnerability is critical
   • BInclude the out-of-scope server in the report as a finding without testing it
   • CTest the server only to confirm the vulnerability and then include it in the report
   • DStop testing, document the finding, and request an extension of scope from the client
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is hired by a company to test the security of its new cloud-based application. The client has provided the tester with a test environment that mirrors the production environment. The rules of engagement specify that the tester must not access any production data. During the test, the tester discovers that the test environment is connected to the production database, and the credentials used in the test environment have access to production data. What is the most appropriate action for the tester to take?

   • ATest the production database to prove the risk, then report the finding
   • BDocument the finding and include it in the final report without mentioning it to the client
   • CContinue testing in the test environment and avoid accessing the production database
   • DStop testing and immediately report the misconfiguration to the client
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which phase of a penetration test involves gathering information about the target without actively attacking it?

   • AReconnaissance
   • BExploitation
   • CPost-exploitation
   • DReporting
   Reveal Solution Discussion Select an answer first