A company is preparing for a compliance audit and needs to demonstrate that its external-facing systems are secure. The company wants a penetration test that simulates a real-world attacker with no insider knowledge, but the test must be completed quickly and with minimal disruption to operations. Which type and approach combination is most appropriate?

Gray-box testing with manual testing

White-box testing with manual testing

White-box testing with automated scanning

Black-box testing with automated scanning

After completing a penetration test, the tester has documented all findings, including the vulnerabilities discovered, the data accessed, and the systems compromised. What is the final step the tester must perform?

Retest the vulnerabilities to confirm they exist

Clean up any changes made during the test

Present the findings to the client in a comprehensive report

A small e-commerce company has a tight budget and a short timeline. They want to identify common vulnerabilities in their public web application before a major sales event. They do not need deep exploitation or a full report. Which approach is most appropriate?

Automated vulnerability scanning

Full manual penetration testing

Red team exercise with social engineering

Hybrid testing with manual verification of all findings

EC-CouncilEthical Hacking Essentials

Domain 8Objective 4

Types, Phases, and Approaches to Penetration Testing EHE Practice Questions (Page 3)

Part of the Cloud Computing and Penetration Testing domain, which makes up ~12% of our current practice bank.

17questions here

4free pages

3concepts

Questions 11–15

11expert · hard
A company is preparing for a compliance audit and needs to demonstrate that its external-facing systems are secure. The company wants a penetration test that simulates a real-world attacker with no insider knowledge, but the test must be completed quickly and with minimal disruption to operations. Which type and approach combination is most appropriate?
Select an answer first
12application · medium
After completing a penetration test, the tester has documented all findings, including the vulnerabilities discovered, the data accessed, and the systems compromised. What is the final step the tester must perform?
Select an answer first
13foundation · easy
Which penetration testing phase involves defining the scope, rules of engagement, and legal authorization before any technical testing begins?
Select an answer first
14application · medium
A small e-commerce company has a tight budget and a short timeline. They want to identify common vulnerabilities in their public web application before a major sales event. They do not need deep exploitation or a full report. Which approach is most appropriate?
Select an answer first
15application · medium
A penetration tester is preparing to test a client's network. The tester has been given the IP address range and the goal of identifying open ports and services. According to the penetration testing phases, which phase should the tester perform first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Types, Phases, and Approaches to Penetration Testing EHE Practice Questions (Page 3)

Questions 11–15

After completing a penetration test, the tester has documented all findings, including the vulnerabilities discovered, the data accessed, and the systems compromised. What is the final step the tester must perform?

Which penetration testing phase involves defining the scope, rules of engagement, and legal authorization before any technical testing begins?

A small e-commerce company has a tight budget and a short timeline. They want to identify common vulnerabilities in their public web application before a major sales event. They do not need deep exploitation or a full report. Which approach is most appropriate?

A penetration tester is preparing to test a client's network. The tester has been given the IP address range and the goal of identifying open ports and services. According to the penetration testing phases, which phase should the tester perform first?

Keep studying — Cloud Computing and Penetration Testing