Penetration Testing Application GCED Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is lateral movement in the context of post-exploitation?

   • AMoving from one compromised system to another within the network
   • BEscalating privileges from a standard user to an administrator
   • CDeleting logs to avoid detection
   • DTransferring data out of the compromised network
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After completing a penetration test, the tester must present findings to both technical staff and executives. The technical staff need detailed remediation steps, while executives need a high-level risk summary. What is the best way to structure the report?

   • APublish the report on a public website for transparency.
   • BOnly provide the executive summary to avoid overwhelming technical staff.
   • CProvide a single technical report with all details and assume executives will read it.
   • DInclude an executive summary at the beginning and a detailed technical appendix at the end.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the remediation recommendations in a penetration testing report?

   • ATo help the organization fix the identified vulnerabilities and improve security
   • BTo assign blame for the security weaknesses
   • CTo provide a step-by-step guide for exploiting the vulnerabilities
   • DTo justify the cost of the penetration test
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester has completed an assessment and identified a critical vulnerability in a customer's application. The customer's management is concerned about the business impact and wants to understand the risk in financial terms. Which approach should the tester take in the report?

   • AFocus on the technical details and leave the business impact to management
   • BProvide a detailed technical explanation of the vulnerability and its exploitation
   • CQuantify the potential financial loss using industry-standard risk assessment frameworks
   • DRecommend immediate remediation without providing cost estimates
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is planning an engagement for a client that wants to test its web application's resistance to common attacks. The client has a limited budget and wants to focus on the OWASP Top 10. Which methodology is most appropriate?

   • AUse the OSSTMM methodology to measure operational security metrics.
   • BUse a generic vulnerability scanner without a defined methodology.
   • CUse the OWASP Testing Guide to plan and execute tests for the Top 10 vulnerabilities.
   • DUse the PTES methodology to perform a full network penetration test.
   Reveal Solution Discussion Select an answer first