Penetration Testing GCCC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of incident response, what is a key role of penetration testing?

   • ATo proactively identify security weaknesses before they are exploited by real attackers.
   • BTo replace the need for an incident response plan.
   • CTo provide a real-time alerting mechanism for ongoing security incidents.
   • DTo ensure compliance with regulatory requirements only.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of privilege escalation in post-exploitation?

   • ATo cover tracks and remove evidence of the compromise.
   • BTo move laterally across the network to other systems.
   • CTo maintain persistent access to the compromised system.
   • DTo gain higher-level permissions on a compromised system.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company wants to assess the security of its new web application before production deployment. The security manager is concerned about the cost and potential disruption of a full penetration test. The manager asks the security team to recommend a testing approach that provides a thorough assessment of the application's business logic and authentication flows while minimizing the risk of disrupting operations. Which approach should the team recommend?

   • AA vulnerability scan using an automated tool only
   • BA red-team exercise that includes social engineering and physical intrusion
   • CA white-box penetration test with credentialed access and a defined test window
   • DAn uncredentialed black-box test performed during peak business hours
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is conducting reconnaissance on a target organization. The tester has identified the company's public IP ranges from WHOIS records. The tester now wants to discover which specific hosts are alive and what services they are running, but the tester wants to minimize the chance of detection by the target's intrusion detection system (IDS). Which approach should the tester take?

   • ASend a single ICMP echo request to each IP address
   • BUse only passive techniques such as sniffing network traffic
   • CRun a full connect scan on all ports at maximum speed
   • DPerform a slow, low-and-slow port scan using random source ports and delays
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company hires a penetration testing firm to assess its internal network. The scope is limited to the internal network and excludes any external-facing systems. During the test, the tester discovers that an internal server is also accessible from the internet. What should the tester do?

   • ADocument the external exposure and continue testing the internal scope
   • BTest the server's external interface because it is a critical finding
   • CIgnore the external exposure because it is not in scope
   • DStop the test and report the scope violation to the client
   Reveal Solution Discussion Select an answer first