Penetration Testing Scoping and Engagement CPENT Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   During a penetration test, the tester discovers that a critical database server is exposed to the internet and is vulnerable to a known exploit. The client's stakeholders have not yet approved testing of that server. What is the most appropriate action for the tester?

   • ATest the server but only with passive techniques.
   • BDocument the finding and request an immediate scope expansion from the client.
   • CTest the server immediately because it is a critical finding.
   • DStop all testing and wait for the client to expand the scope.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In a white-box penetration test, which information is typically provided to the tester?

   • AThe results of a previous penetration test
   • BNetwork diagrams, source code, and credentials for the target environment
   • CA list of external IP addresses but no internal documentation
   • DOnly the target organization's name and public website
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A client wants to test the security of their cloud infrastructure, but they are unsure about the shared responsibility model. They want to ensure that the test does not violate the cloud provider's terms of service. What is the most important step for the tester?

   • APerform the test without informing the cloud provider, as the client owns the infrastructure.
   • BTest only the client's virtual machines and ignore the provider's shared infrastructure.
   • CReview the cloud provider's penetration testing policy and obtain any necessary approvals before testing.
   • DAssume that the client's authorization is sufficient and proceed with testing.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester is completing an engagement and preparing the final report. The client has requested that the report include actionable remediation steps. The tester has identified a critical vulnerability in a web application. What is the most important element to include in the report for this vulnerability?

   • AA list of all the tools used during the engagement.
   • BA detailed description of the vulnerability and step-by-step remediation guidance.
   • CThe exact exploit code used to test the vulnerability.
   • DA summary of the tester's qualifications and experience.
   Reveal Solution Discussion Select an answer first