Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is planning an assessment for a client with a complex network. The client wants to ensure that the testing team has a clear understanding of the boundaries and expectations. Which document should be created first?

   • AA remediation plan for each potential issue
   • BA detailed rules of engagement document
   • CA list of all discovered vulnerabilities
   • DA final report template
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is planning an assessment for a client that has a strict change-management process. The tester wants to minimize the risk of disrupting production systems. Which recommendation should the tester follow?

   • AAsk the client to disable change management during the test.
   • BRun the test without informing the change-management team to avoid delays.
   • CSchedule the test during a maintenance window and coordinate with the change-management team.
   • DUse only passive techniques to avoid any impact.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A penetration tester is hired to assess a client's environment, but the client's legal team has not yet signed the rules of engagement. The client's IT manager insists that testing must begin immediately to meet a compliance deadline. What should the tester do?

   • ABegin testing with a verbal agreement to save time
   • BStart with passive reconnaissance only, which is low risk
   • CAsk the IT manager to sign a temporary waiver
   • DRefuse to begin testing until the rules of engagement are signed
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration testing team is planning an assessment for a client. The client wants to minimize disruption to business operations. Which recommendation should the team implement to achieve this goal?

   • ARun all tests in parallel to complete the assessment faster
   • BPerform testing only on the production environment to ensure accuracy
   • CUse aggressive scanning tools to identify all vulnerabilities quickly
   • DSchedule testing during off-peak hours and use non-destructive techniques where possible
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A penetration tester is assessing a client's cloud environment that includes a shared responsibility model. The client wants to know which vulnerabilities are the client's responsibility to fix versus the cloud provider's. What should the tester do?

   • AMap each finding to the shared responsibility model and clarify who is responsible for remediation
   • BReport all findings as the provider's responsibility to protect the client
   • CReport all findings as the client's responsibility to avoid confusion
   • DExclude findings that involve the cloud provider's infrastructure
   Reveal Solution Discussion Select an answer first