A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a potential SQL injection vulnerability in a login form. The tester wants to confirm whether the vulnerability is real before including it in the report. Which action should the tester take?

Ignore the finding because scanners are always accurate

Run the scanner again with the same settings

Accept the scanner's result and report it as confirmed

Manually test the login form with crafted SQL injection payloads

A security team is conducting an internal penetration test. They have been given a standard domain user account and permission to scan the internal network. The team runs an unauthenticated vulnerability scan and finds several critical vulnerabilities. However, the team lead wants to reduce false positives and better understand the actual exploitability of the findings. Which action should the team take next?

Immediately attempt to exploit all critical vulnerabilities

Report the unauthenticated scan results directly to management

Run a credentialed scan using the provided domain account

Disable the vulnerability scanner and use manual testing only

What is the primary purpose of a penetration test?

To implement security controls and remediate identified vulnerabilities.

To verify that all software licenses are properly maintained and up to date.

To identify and exploit vulnerabilities in a controlled manner to assess the security of a system or network.

To continuously monitor network traffic for malicious activity and alert on anomalies.

A penetration tester is performing reconnaissance on a target organization. The tester has already gathered employee names from LinkedIn and identified the company's email format from a few public email addresses. The tester now wants to discover additional internal hostnames and network ranges without directly interacting with the target's systems. Which technique is most appropriate?

Running a full port scan of the target's public IP ranges

Sending phishing emails to employees to gather internal network information

Querying the target's DNS servers for zone transfers and using search engines to find cached DNS records

Using a vulnerability scanner to enumerate internal hosts

GIAC Critical Controls Certification

Domain 7Objective 2

Penetration Testing GCCC Practice Questions (Page 8)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a potential SQL injection vulnerability in a login form. The tester wants to confirm whether the vulnerability is real before including it in the report. Which action should the tester take?
Select an answer first
37application · medium
A security team is conducting an internal penetration test. They have been given a standard domain user account and permission to scan the internal network. The team runs an unauthenticated vulnerability scan and finds several critical vulnerabilities. However, the team lead wants to reduce false positives and better understand the actual exploitability of the findings. Which action should the team take next?
Select an answer first
38foundation · easy
What is the primary purpose of a penetration test?
Select an answer first
39application · medium
A penetration tester is performing reconnaissance on a target organization. The tester has already gathered employee names from LinkedIn and identified the company's email format from a few public email addresses. The tester now wants to discover additional internal hostnames and network ranges without directly interacting with the target's systems. Which technique is most appropriate?
Select an answer first
40application · medium
A penetration tester has gained access to a domain controller and wants to demonstrate the ability to maintain access. The tester installs a service that runs automatically at startup and connects back to a command-and-control server. Which post-exploitation activity is the tester performing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Penetration Testing GCCC Practice Questions (Page 8)

Questions 36–40

A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a potential SQL injection vulnerability in a login form. The tester wants to confirm whether the vulnerability is real before including it in the report. Which action should the tester take?

What is the primary purpose of a penetration test?

A penetration tester has gained access to a domain controller and wants to demonstrate the ability to maintain access. The tester installs a service that runs automatically at startup and connects back to a command-and-control server. Which post-exploitation activity is the tester performing?

Keep studying — Incident Response and Testing