Penetration Testing Fundamentals ECSS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A penetration tester is negotiating the rules of engagement with a client. The client wants the tester to avoid any actions that could cause a denial of service, but the tester believes that testing for DoS vulnerabilities is important. Which approach should the tester take?

   • AConduct DoS testing without telling the client, then report the results.
   • BRefuse to conduct the test unless DoS testing is allowed.
   • CAgree to avoid DoS testing and document the limitation in the report.
   • DConduct a limited DoS test during off-peak hours without prior approval.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is planning a penetration test for a web application that handles customer data. They need a methodology that provides detailed guidance on testing web application security, including a checklist of test cases for common vulnerabilities like SQL injection and cross-site scripting. Which methodology should they choose?

   • APTES
   • BOSSTMM
   • COWASP Testing Guide
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration testing report includes a finding that a web server is running an outdated version of Apache with known vulnerabilities. The report assigns a CVSS score of 9.8 and recommends upgrading to the latest version. What is the purpose of including the CVSS score in the report?

   • ATo prove that the server was actually exploited during the test.
   • BTo show the exact exploit code that can be used to attack the server.
   • CTo replace the need for a detailed remediation recommendation.
   • DTo provide a standardized measure of the severity of the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which penetration testing methodology is specifically focused on web application security?

   • AOWASP
   • BPTES
   • COSSTMM
   • DISO 27001
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which type of penetration testing provides the tester with partial information, such as network diagrams or user-level credentials?

   • ARed-team testing
   • BBlack-box testing
   • CGray-box testing
   • DWhite-box testing
   Reveal Solution Discussion Select an answer first