Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is conducting an assessment for a client that has a mature security program. The client wants the test to focus on validating the effectiveness of their security controls, not just finding vulnerabilities. What type of testing approach should the tester use?

   • AUse a vulnerability scanner to identify known vulnerabilities.
   • BPerform a compliance audit against industry standards.
   • CReview the client's security policies and procedures only.
   • DUse a red-team approach that attempts to bypass the client's security controls.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is hired to test a company's cloud infrastructure. The client wants to ensure that the test does not affect other tenants in the shared cloud environment. What should the tester do?

   • ATest all resources in the same region to be thorough.
   • BUse aggressive scanning techniques to find all vulnerabilities quickly.
   • CDefine the scope to include only the client's resources and use cloud-specific testing guidelines.
   • DAvoid testing the cloud environment because of the risks.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration testing team has completed an assessment and is preparing the final report. The client has requested that the report be delivered in a format that can be easily shared with external auditors. The team wants to ensure the report is both comprehensive and suitable for this purpose. What should the team do?

   • ADeliver the report verbally and provide no written documentation.
   • BInclude an executive summary, technical details, and remediation recommendations in a structured format.
   • CCreate a separate report for auditors that excludes technical details.
   • DProvide only the raw scan data to the auditors.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is using a structured methodology for an assessment. The tester has completed the reconnaissance phase and is about to start active exploitation. What should the tester do before proceeding?

   • AUse a different methodology to avoid detection.
   • BReview the rules of engagement to confirm that active exploitation is permitted.
   • CProceed immediately to exploitation to save time.
   • DInform the client after the exploitation is complete.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration testing team is conducting an assessment for a client that has a very tight budget. The client wants to prioritize the most critical findings. The team has identified several vulnerabilities with different severity levels. What is the best way to present the findings to support the client's prioritization?

   • ARank the findings by risk, considering both likelihood and impact, and provide remediation guidance.
   • BProvide a raw data dump of all test results.
   • CList the findings in the order they were discovered.
   • DPresent only the vulnerabilities with a CVSS score above 9.0.
   Reveal Solution Discussion Select an answer first