Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is preparing for an engagement with a client that has a strict change management process. The client requires that any changes to production systems be approved by a change advisory board (CAB). How should the tester handle this requirement?

   • APerform the test only in a staging environment to avoid the change management process.
   • BInclude the change management process in the rules of engagement and coordinate with the CAB for any required approvals.
   • CIgnore the change management process because the test is authorized.
   • DAsk the client to waive the change management process for the duration of the test.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key implication of a black-box engagement compared to a white-box engagement?

   • AThe tester must rely on reconnaissance to discover the target's attack surface
   • BThe tester is provided with network diagrams and source code
   • CThe engagement is always more thorough than a white-box test
   • DThe tester has full knowledge of the target's internal architecture
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester is scoping an engagement for a multinational client. The client has offices in two countries with different data protection laws. The client wants to test a system that stores personal data of citizens from both countries. The tester must ensure the engagement complies with both legal frameworks. What is the most important consideration?

   • AObtain written consent from all individuals whose data is stored in the system.
   • BPerform the test only in the country with the stricter data protection law.
   • CEnsure the rules of engagement include legal review and compliance with both countries' data protection regulations.
   • DUse only test data that is not considered personal data under either law.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is scoping an engagement for a client that has a small IT team and limited resources. The client wants to test their network but is concerned about the time and effort required. The tester has proposed a grey-box engagement. What is the primary benefit of this approach for the client?

   • AIt provides the most realistic simulation of an external attacker.
   • BIt reduces the time and effort required compared to a black-box test, while still providing valuable findings.
   • CIt eliminates the need for a rules of engagement document.
   • DIt guarantees that all vulnerabilities will be found.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester is preparing the final report for an engagement. The client has requested that the report include a summary of the testing methodology, a list of findings, and remediation guidance. The tester has also identified a critical vulnerability that requires immediate attention. What is the most appropriate way to present this information in the report?

   • AInclude an executive summary that highlights the critical vulnerability and its potential impact, followed by detailed findings and remediation steps.
   • BProvide only the critical vulnerability details and skip the methodology and other findings.
   • CInclude the methodology and findings but place the remediation guidance in a separate document.
   • DList all findings in order of severity, with the critical vulnerability first, but do not include remediation steps.
   Reveal Solution Discussion Select an answer first