Penetration Testing Essential Concepts CPENT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company has just deployed a new internal HR system. The security team wants to ensure that the system is not vulnerable to common attacks. They have a limited budget and need to identify as many potential weaknesses as possible in a short time. They decide to run an automated scanner that checks for known vulnerabilities and misconfigurations. What is the primary limitation of this approach compared to a full penetration test?

   • AIt will produce a large number of false positives that require manual verification
   • BIt will not provide any remediation guidance for the identified vulnerabilities
   • CIt will not identify any vulnerabilities that are not in the scanner's database
   • DIt will only test the application from an external perspective
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is planning an engagement and needs to define the specific IP addresses, domains, and applications that are in scope. The tester also needs to identify any systems that are explicitly out of scope. Which phase of the penetration testing process does this activity belong to?

   • APre-engagement
   • BReporting
   • CExploitation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A penetration tester has completed an engagement and is writing the final report. The client's legal team requests that the report not include specific exploit steps or proof-of-concept code, citing concerns about the report being leaked. However, the client's IT team needs enough detail to remediate the vulnerabilities. What is the best approach?

   • AInclude detailed technical findings in the main report and provide exploit steps and PoC code in a separate, restricted appendix
   • BProvide a high-level summary only, with no technical details
   • CInclude full exploit steps and PoC code in the report because the IT team needs them
   • DRefuse to write the report until the legal team changes its position
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During a penetration test, the tester discovers a critical vulnerability in a third-party payment processing system that is outside the defined scope. The rules of engagement explicitly state that only the company's internal web application is in scope. What should the tester do?

   • AContinue in-scope testing and notify the client of the out-of-scope finding, asking for guidance
   • BStop testing and report the issue to the client immediately
   • CDocument the finding and include it in the final report
   • DExploit the vulnerability to demonstrate the risk to the client
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In which type of penetration testing does the tester have no prior knowledge of the target environment?

   • ARed-team testing
   • BGray-box testing
   • CWhite-box testing
   • DBlack-box testing
   Reveal Solution Discussion Select an answer first