Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A penetration tester is preparing a rules of engagement (RoE) document for a client. The client has specified that the test must not disrupt business operations during peak hours (9 AM to 5 PM) and that any testing that could cause a denial of service must be approved in advance. The tester plans to run a vulnerability scan that may cause high network load. What is the most appropriate action for the tester to take?

   • ASchedule the scan for after business hours and include it in the RoE as an approved activity.
   • BSkip the scan entirely to avoid any risk of disruption.
   • CRun the scan during peak hours to get realistic results, but notify the client just before starting.
   • DAsk the client to sign a waiver that absolves the tester of any damage caused by the scan.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration tester is planning a white-box engagement for a client. The client has provided the tester with access to the source code of their application and the network architecture. The tester is expected to identify vulnerabilities that might be missed in a black-box test. What is the primary advantage of this type of engagement?

   • AIt allows for a more thorough and efficient assessment because the tester has full knowledge of the environment.
   • BIt simulates a real-world attacker more accurately than other engagement types.
   • CIt eliminates the need for a rules of engagement document.
   • DIt requires less time and effort than other engagement types.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of including remediation guidance in a penetration test report?

   • ATo provide step-by-step instructions for fixing identified vulnerabilities
   • BTo demonstrate the tester's technical expertise
   • CTo justify the cost of the penetration test
   • DTo replace the need for a vulnerability scanner
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of communicating scope and engagement parameters to stakeholders before a penetration test begins?

   • ATo provide the tester with a list of known vulnerabilities
   • BTo obtain the tester's professional certification
   • CTo ensure stakeholders understand what will be tested and what is excluded
   • DTo finalize the penetration testing report
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester is planning an engagement with a client. The client wants to ensure that the testing does not disrupt business operations. Which rules of engagement component is most important to address this concern?

   • AThe list of testing tools to be used
   • BThe schedule of testing windows and any prohibited actions that could cause downtime
   • CThe format of the final report
   • DThe names of the testers on the team
   Reveal Solution Discussion Select an answer first