Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which item is most likely to be documented as an out-of-scope boundary in a penetration testing engagement?

   • AThe production customer database server
   • BThe contact information for the emergency response team
   • CThe report delivery date
   • DThe testing methodology to be used
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During the scoping phase of a penetration test, which element is considered a constraint rather than a target?

   • AA list of internal IP ranges authorized for testing
   • BA specific web application URL to be tested
   • CA requirement that testing occur only between 2:00 AM and 6:00 AM
   • DA list of third-party services that are in scope
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is about to start an engagement. The client's security team has asked to be notified immediately if the tester discovers any critical vulnerabilities during the test. How should the tester handle this request?

   • AWait until the final report is delivered to share critical findings.
   • BNotify the security team immediately upon discovering a critical vulnerability, even if the test is ongoing.
   • COnly notify the security team if the vulnerability is exploitable.
   • DInclude the critical findings in the final report only, as that is the standard deliverable.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A penetration tester is completing a black-box engagement for a client. The client has requested that the final report include a risk rating for each vulnerability. The tester has identified a vulnerability that requires a high level of skill to exploit and has a low impact on the business. What is the most appropriate risk rating for this vulnerability?

   • ALow, because the vulnerability is difficult to exploit and has low business impact.
   • BHigh, because any vulnerability that requires high skill is still a serious risk.
   • CMedium, because the vulnerability is present but the impact is low.
   • DCritical, because the vulnerability could be exploited by a determined attacker.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which component is a standard element of a rules of engagement (RoE) document?

   • AThe detailed exploit code to be used
   • BThe final report's executive summary
   • CThe tester's personal resume
   • DThe approved testing time windows and authorized IP ranges
   Reveal Solution Discussion Select an answer first