Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which stakeholder group is most likely to need a non-technical summary of the engagement scope?

   • ANetwork engineers
   • BSecurity analysts
   • CExecutive management
   • DPenetration testers
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which item is a typical deliverable of a penetration testing engagement?

   • AA copy of the organization's source code
   • BA detailed penetration test report including findings and remediation guidance
   • CA list of all employee passwords
   • DA guarantee that all vulnerabilities have been fixed
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is scoping an engagement for a client that hosts a public web application and an internal HR system. The client wants the tester to attempt to breach the internal HR system but explicitly forbids any testing of the third-party payment processor that the web application integrates with. Which action best aligns with the scope definition?

   • AAsk the payment processor for permission to test on behalf of the client.
   • BTest the payment processor passively by observing network traffic without sending any packets.
   • CExclude the payment processor from testing and document the boundary in the rules of engagement.
   • DInclude the payment processor in the scope but only test it during off-peak hours.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A penetration tester is scoping an engagement for a client that has a multi-tenant cloud environment. The client wants to test their application, but the application shares infrastructure with other tenants. The client has provided the tester with access to their own virtual network and resources. What is the most important consideration for the scope?

   • AInclude the entire cloud infrastructure in the scope to ensure a thorough test.
   • BTest only the application's functionality without accessing the underlying infrastructure.
   • CAsk the cloud provider for permission to test the entire infrastructure.
   • DEnsure that the scope is limited to the client's own virtual network and resources, and avoid any interaction with other tenants.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester is communicating the scope of an engagement to a client's IT team. The client's IT team is concerned that the testing might affect a legacy system that is critical to operations. The tester has already defined the scope to exclude that system. What is the best way to communicate this to the IT team?

   • AInclude the legacy system in the scope but only test it during off-hours.
   • BExplain that the testing will be performed carefully and that the legacy system is unlikely to be affected.
   • CProvide a clear list of in-scope and out-of-scope systems, explicitly stating that the legacy system is excluded.
   • DAsk the IT team to monitor the legacy system during the test and report any issues.
   Reveal Solution Discussion Select an answer first