Penetration Testing Fundamentals ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration tester is hired to assess a client's external web application. The client provides the application's source code and API documentation but asks the tester to simulate an external attacker without any internal network access. The tester is allowed to test only the staging environment, not production. During the engagement, the tester discovers a critical vulnerability in a third-party component that is also present in production. According to the rules of engagement, what should the tester do?

   • AStop the test and refuse to continue until the client expands the scope to include production.
   • BImmediately notify the client's security team and ask for permission to test production.
   • CReport the finding in the final report and recommend that the client patch the component in both environments.
   • DExploit the vulnerability in production to confirm the impact before reporting it.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key difference between a vulnerability assessment and a penetration test?

   • AA vulnerability assessment identifies and lists vulnerabilities, while a penetration test exploits them to determine real-world impact
   • BA vulnerability assessment requires written authorization, while a penetration test does not
   • CA vulnerability assessment actively exploits vulnerabilities, while a penetration test only scans for them
   • DA vulnerability assessment is always automated, while a penetration test is always manual
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which penetration testing methodology is known for its comprehensive, seven-phase approach that includes pre-engagement interactions and reporting?

   • APTES
   • BOWASP
   • COSSTMM
   • DNIST SP 800-115
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which penetration testing phase involves actively sending probes to the target to identify open ports and running services?

   • AReporting
   • BExploitation
   • CReconnaissance
   • DScanning
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration testing report lists a critical vulnerability in a customer-facing application. The remediation recommendation is to apply a vendor patch. However, the client's change management policy requires a 30-day testing period before patches can be deployed to production. What should the report include to address this constraint?

   • AA temporary mitigation measure, such as a web application firewall rule, to reduce risk until the patch is deployed.
   • BA note that the vulnerability cannot be fixed due to the change management policy.
   • CA recommendation to ignore the vulnerability because the patch will be applied eventually.
   • DA request to bypass the change management policy for this patch.
   Reveal Solution Discussion Select an answer first