Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium · select all that apply

   A penetration testing team is planning an assessment for a client. The team wants to follow best practices for effective penetration testing. Which of the following actions align with these best practices? (Select all that apply.)

   • AUse a structured methodology such as PTES or OWASP.
   • BDocument all findings and actions taken during the test.
   • CKeep the test results confidential from the client until the final report.
   • DPerform the test without a written agreement to save time.
   • EDefine clear objectives and scope before starting the test.
   Check answers Discussion Select an answer first
2. 7expert · hard · select all that apply

   A penetration tester is planning a retest after a client has implemented fixes for previously reported vulnerabilities. Which practices should the tester follow to ensure an effective retest? (Select all that apply.)

   • ADocument the retest results and compare them with the original findings
   • BVerify each fixed vulnerability with the same or equivalent test method used originally
   • CTest for new vulnerabilities introduced by the fixes
   • DSkip the retest if the client says the fixes are complete
   • EFocus only on the previously reported vulnerabilities to save time
   Check answers Discussion Select an answer first
4. 8expert · hard

   A penetration testing team is preparing for a test that will involve social engineering. The client has approved the test but is concerned about employee morale. The team wants to minimize negative impact while still testing the effectiveness of security awareness. What is the best approach?

   • APerform the social engineering test without informing anyone to ensure realism.
   • BSkip social engineering testing to avoid any negative impact.
   • CDesign the social engineering test with clear rules of engagement and a post-test awareness campaign.
   • DOnly test employees who have been with the company for a long time.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is hired to assess a financial institution's internal network. During the test, the tester discovers a critical vulnerability that could allow immediate unauthorized access to customer data. What is the most appropriate immediate action?

   • AReport the critical finding to the client immediately, even if the final report is not ready
   • BDocument the finding but do not share it until the end of the engagement
   • CExploit the vulnerability further to demonstrate the full impact
   • DWait until the final report is complete to provide all findings at once
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is proper documentation essential during a penetration test?

   • ATo satisfy legal requirements in all jurisdictions
   • BTo increase the length of the final report
   • CTo prove the tester's skills to potential employers
   • DTo provide evidence and support remediation efforts
   Reveal Solution Discussion Select an answer first