Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration tester is conducting a test and accidentally causes a denial of service on a critical system. What should the tester do immediately?

   • AAttempt to fix the issue silently without informing the client
   • BStop testing, inform the client, and assist with recovery
   • CHide the incident to avoid damaging the relationship with the client
   • DContinue testing other systems and document the incident in the final report
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A penetration tester is engaged to assess a client's hybrid cloud environment. The client requires that testing not disrupt a critical production database that is replicated across regions. The tester must also comply with a regulatory requirement that no test data be stored outside the client's home country. Which approach best satisfies both constraints?

   • ARun the test during off-peak hours on the production database
   • BPerform the test from a cloud region outside the country and encrypt all data
   • CUse a staging environment in the home country and avoid the production database
   • DTest the production database but only with read-only queries
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A penetration testing team is working on a large assessment with multiple testers. The team lead wants to ensure that the testing is consistent and that findings are not duplicated. What is the best practice to achieve this?

   • AWait until the end of the test to compile all findings.
   • BUse a centralized documentation platform and assign specific areas to each tester.
   • CLet each tester document findings in their own format.
   • DHave all testers test the same systems to ensure thorough coverage.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During a penetration test, a tester discovers a critical vulnerability that could cause immediate harm if exploited. According to ethical guidelines, what should the tester do FIRST?

   • APublish the vulnerability publicly to warn others
   • BReport the vulnerability to the client immediately
   • CContinue testing and include it in the final report
   • DExploit the vulnerability to prove its impact
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice is a recommended best practice for conducting an effective penetration test?

   • APerforming tests only during non-business hours to avoid detection
   • BFollowing a structured methodology such as PTES or OSSTMM
   • CUsing automated tools exclusively to save time
   • DUsing an ad-hoc approach to discover more vulnerabilities
   Reveal Solution Discussion Select an answer first