Types, Phases, and Approaches to Penetration Testing EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration tester is conducting a test and has just finished identifying open ports and services on the target network. The tester now needs to determine whether any of the identified services have known vulnerabilities. Which phase of penetration testing is the tester currently in?

   • AReconnaissance
   • BExploitation
   • CPost-exploitation
   • DScanning
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester has completed the reconnaissance and scanning phases and has successfully exploited a vulnerability to gain initial access to a target system. According to the standard penetration testing phases, what should the tester do next?

   • AReturn to the reconnaissance phase to gather more information
   • BBegin the reporting phase immediately
   • CPerform post-exploitation activities to assess the value of the compromised system
   • DClean up all traces and end the engagement
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A company wants to test the security of its public-facing web application. The testers are given no prior knowledge of the application, but they are allowed to use automated scanners and manual techniques. The goal is to simulate an external attacker with no insider information. Which type of penetration test should be conducted?

   • AInternal testing
   • BGray-box testing
   • CWhite-box testing
   • DBlack-box testing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration testing team is planning an engagement for a client with a complex, custom-built application. The team wants to ensure that the testing is thorough and can adapt to unexpected findings. However, the client has a limited budget and wants to keep costs down. Which approach should the team recommend?

   • AManual testing only
   • BSkip testing and rely on code review
   • CAutomated testing only
   • DHybrid testing with automated scanning and manual verification
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration testing team is assessing a legacy application that is critical to business operations. The team has limited time and must avoid any disruption to the application. The team has been given the application's source code and configuration. Which approach and testing type combination is most appropriate?

   • AManual black-box testing
   • BManual white-box testing
   • CAutomated gray-box testing
   • DAutomated black-box testing
   Reveal Solution Discussion Select an answer first