Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester is completing a grey-box engagement for a client. The client has provided the tester with a list of IP addresses and credentials for the target systems. During the test, the tester discovers a critical vulnerability that could allow an attacker to gain administrative access. The client has requested that the final report include a proof of concept (PoC) for each vulnerability. What is the most important consideration when including the PoC?

   • AProvide only a high-level description of the vulnerability without a PoC.
   • BInclude the full exploit code and all credentials used during the test.
   • CInclude a PoC that is only for the most critical vulnerability and skip the others.
   • DEnsure that the PoC is detailed enough for the client to reproduce the issue, but remove any sensitive data or credentials.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is working with a client that has multiple business units. One business unit wants to test a critical application, but another business unit is concerned about the test affecting their shared infrastructure. The tester must communicate the scope to all stakeholders. What is the best approach?

   • AAsk the requesting business unit to sign a waiver absolving the tester of any impact on other units.
   • BCommunicate the scope only to the business unit that requested the test.
   • CHold a meeting with all business units to discuss the scope, boundaries, and potential impact on shared infrastructure.
   • DProceed with the test without informing other business units to avoid delays.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A penetration tester is scoping an engagement for a client that has a complex network with multiple subsidiaries. The client wants to test a specific application that is hosted in a cloud environment, but the application's data is stored in a different region than the client's headquarters. The client has provided the tester with credentials to the cloud environment but has not specified the exact boundaries of the test. The tester must ensure the test does not accidentally access other subsidiaries' data. What is the most critical action the tester should take?

   • AAsk the client to provide a list of all IP addresses in the cloud environment.
   • BTest only the application's functionality without accessing any data.
   • CDefine the scope clearly in the RoE, specifying the exact application and data boundaries, and obtain written authorization from the client.
   • DUse the provided credentials to explore the entire cloud environment to understand the network.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A client wants to test the effectiveness of their security monitoring and incident response processes. They want the test to be as realistic as possible, but they are concerned about the risk of a real attacker causing damage. Which engagement type is most appropriate?

   • AGrey-box, because it provides partial knowledge to the tester.
   • BBlack-box, because it simulates an external attacker and tests the organization's detection and response.
   • CWhite-box, because it provides the most complete assessment of vulnerabilities.
   • DA vulnerability scan, because it is less risky than a penetration test.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is preparing rules of engagement for a client. The client requires that all testing be performed between 2 AM and 6 AM to avoid impacting production. The tester plans to use active scanning tools that may generate alerts. Which component must be explicitly documented in the rules of engagement?

   • AThe authorization to perform active scanning during the specified time window
   • BThe list of vulnerabilities the tester expects to find
   • CThe names of all employees who will be on call during the test
   • DThe exact IP addresses of the tester's scanning infrastructure
   Reveal Solution Discussion Select an answer first