Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A penetration tester is engaged to assess a client's hybrid infrastructure. The client has a strict requirement that no testing may be performed on the production database, but the tester believes the database is the most likely target for attackers. The client also wants a comprehensive assessment. What is the best course of action?

   • ARecommend that the client hire a different tester for the database.
   • BSkip the database and test only the other components.
   • CTest the database anyway because it is critical.
   • DNegotiate a separate, controlled test of the production database during a maintenance window.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration testing team is documenting their findings. They want to ensure that the client can verify the vulnerabilities independently. What should the team include in the documentation?

   • AA list of tools used during the test.
   • BOnly the vulnerability name and severity rating.
   • CThe tester's personal notes and observations.
   • DReproduction steps, evidence, and the impact of each finding.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A penetration tester is engaged to test a client's application that is hosted in a public cloud. The client is concerned about the test affecting other customers who share the same infrastructure. The tester wants to perform a thorough test. What is the best approach?

   • APerform a full exploitation test on the shared infrastructure to find all vulnerabilities.
   • BUse cloud-provider-approved testing methods and limit the test to the client's own resources.
   • CAsk the cloud provider to isolate the client's resources for the test.
   • DTest only the application layer and ignore the underlying infrastructure.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is assessing a client's cloud environment. The client is concerned about data residency regulations and wants to ensure that no data leaves a specific geographic region during testing. What should the tester do?

   • AConfigure all testing tools and data storage to use resources within the required region
   • BAsk the client to sign a waiver accepting the risk of data transfer
   • CUse a VPN to encrypt all traffic, regardless of the region
   • DPerform the test from a remote location and delete all logs after the test
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester is preparing a final report for a client. The client wants to understand the overall security posture and the most critical risks. Which section of the report should be emphasized?

   • AA timeline of all testing activities
   • BDetailed technical findings with raw logs
   • CA list of all tools used during the test
   • DExecutive summary with a risk overview
   Reveal Solution Discussion Select an answer first