Penetration Testing GCCC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is planning a penetration test of its internal network. The compliance team requires that the test not disrupt business operations during working hours. The security team has proposed a test window from 2 AM to 6 AM on a weekend. Which factor is most important to include in the test scope to ensure the test stays within this constraint?

   • AExplicit rules of engagement that define allowed testing hours and emergency contacts
   • BThe credentials for all domain administrator accounts
   • CA list of all employee names and email addresses
   • DA detailed network diagram of the entire company
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A penetration tester is planning an assessment of a large enterprise network. The client has requested that the test be as stealthy as possible to avoid alerting the security operations center (SOC). The tester must balance the need for thorough coverage with the constraint of avoiding detection. Which approach best balances these competing requirements?

   • ARun the scan during off-peak hours when the SOC is less likely to be monitoring
   • BUse only passive reconnaissance techniques and avoid any active scanning
   • CPerform a full port scan and vulnerability scan using default settings to ensure complete coverage
   • DConduct targeted scanning of critical systems and use slower scan rates to reduce the chance of detection
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is conducting a vulnerability assessment of a new web application. They have run an automated scanner and found several potential issues. The team wants to prioritize the findings for remediation. Which factor should be the primary consideration when prioritizing?

   • AThe ease of fixing each vulnerability
   • BThe exploitability and potential business impact of each vulnerability
   • CThe order in which the scanner reported the findings
   • DThe number of vulnerabilities found in each component
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is assigned to assess the external perimeter of a company. The client has approved active scanning of their public IP ranges but has explicitly prohibited any exploitation attempts. The tester begins by querying DNS records, reviewing SSL certificate transparency logs, and searching public code repositories for exposed credentials. After this, the tester runs a credentialed vulnerability scan against the approved targets. Which phase of the penetration testing methodology does the tester's initial information-gathering activity represent?

   • APassive reconnaissance
   • BVulnerability scanning
   • CActive reconnaissance
   • DExploitation
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During a penetration test, a tester has gained access to a Linux server by exploiting a vulnerable web application. The tester has a low-privilege user account. The tester discovers that the server has a cron job running as root that executes a script in a directory where the tester has write permissions. Which post-exploitation technique should the tester use to escalate privileges?

   • AModify the script to include a reverse shell or add a new root user
   • BDelete the cron job to prevent it from running
   • CReplace the cron job with a new one using the current user's crontab
   • DWait for the cron job to run and capture the output
   Reveal Solution Discussion Select an answer first