Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A penetration tester is asked to test a client's application that is hosted on a cloud provider. The client provides credentials for a test account but does not provide written authorization for the cloud provider's environment. What should the tester do?

   • AObtain written authorization from the client that explicitly covers the cloud environment
   • BTest only the application and avoid the underlying cloud infrastructure
   • CAssume the client's request is sufficient and begin testing
   • DProceed with testing because the client provided credentials
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is assessing a client's network that includes both on-premises and cloud resources. The client has a compliance requirement that data must not leave the country. The tester plans to use a cloud-based scanning service. What is the most important consideration?

   • AAsk the client to waive the data residency requirement for the test.
   • BUse a scanning service that is popular and well-reviewed.
   • CAvoid using any cloud-based service to prevent data transfer.
   • DEnsure the scanning service processes data only in the client's approved region.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is conducting an assessment and discovers that a vulnerability is actually a misconfiguration that the client's team already knows about and has accepted the risk for. What should the tester do?

   • ARemove the finding from the report because the client already knows about it
   • BExploit the vulnerability to prove that it is still a risk
   • CReport the finding to the client's regulators without the client's consent
   • DDocument the finding in the report and note that the client has accepted the risk
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A penetration tester is conducting an assessment for a client that has a strict no-downtime policy. The tester plans to test a critical database server. What should the tester do to align with the policy?

   • AUse only non-intrusive tests and avoid any actions that could cause downtime.
   • BRun a full exploitation test and hope the server does not crash.
   • CTest the server during business hours to ensure staff are available.
   • DSkip testing the database server entirely.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is preparing to assess a client's web application. The client wants to ensure that the testing process is repeatable and that results can be compared over time. Which practice should the tester adopt?

   • AUse a structured methodology and document each step taken
   • BUse a different methodology each time to cover more ground
   • CPerform tests in an ad-hoc manner to simulate a real attacker
   • DRely on automated tools only and save the raw output
   Reveal Solution Discussion Select an answer first