Penetration Testing GCCC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After completing a penetration test, a tester must produce a report for the client's management team, which is not highly technical. The report should highlight the most critical findings and the business risk they pose. Which section of the report should be written with this audience in mind?

   • ARaw scan output and logs
   • BExecutive summary
   • CMethodology and tools used
   • DTechnical findings and evidence
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which post-exploitation activity involves using a compromised system to access other systems on the network?

   • ALateral movement
   • BPersistence
   • CPrivilege escalation
   • DExfiltration
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is conducting reconnaissance on a target organization. The tester has gathered information from public sources and now needs to identify open ports and services on the target's external IP range. The client has asked the tester to minimize the risk of detection. Which technique should the tester use?

   • AUse a ping sweep to identify live hosts before scanning
   • BUse a UDP scan on all ports
   • CPerform a SYN scan on common ports with a slow timing rate
   • DPerform a full TCP connect scan on all ports
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is considering hiring a penetration testing firm. The company's primary goal is to identify vulnerabilities in its new web application before it goes live. The company also wants to ensure that the test does not disrupt the development environment. Which type of penetration test would best meet these needs?

   • AA gray-box test with limited knowledge of the application
   • BA white-box test with full knowledge of the application's source code and architecture
   • CA black-box test with no prior knowledge of the application
   • DA red team exercise that simulates a full attack
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is following the PTES methodology. The tester has completed the intelligence gathering phase and is now planning the next steps. The client has requested that the tester focus on the most critical vulnerabilities and avoid wasting time on low-risk issues. Which phase should the tester prioritize next?

   • AVulnerability analysis
   • BExploitation
   • CReporting
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first