Penetration Testing Application GCED Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During an internal penetration test, a tester discovers that a web application's login form does not lock out accounts after multiple failed attempts. The tester wants to confirm this vulnerability and document its impact. Which action should the tester take next?

   • APerform a brute-force attack using a small wordlist against a test account created for the assessment
   • BImmediately report the lack of lockout as a critical finding without further testing
   • CRun a large-scale distributed brute-force attack against all user accounts to prove impact
   • DCheck the application's password policy to see if it requires complex passwords
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester has completed an assessment and is writing the final report. The tester needs to ensure that the report is useful for both technical and non-technical stakeholders. Which approach is most appropriate?

   • AProvide only the executive summary and omit technical details
   • BFocus only on the vulnerabilities and their remediation steps
   • CInclude a detailed technical appendix and an executive summary with business impact
   • DWrite the report in highly technical language for all sections
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify employee email addresses and potential technology stacks without directly interacting with the target's systems. Which source is most appropriate for this task?

   • ADNS zone transfer attempt against the target's authoritative name servers
   • BPort scan of the target's public IP range
   • CSend a phishing email to a known employee to gather information
   • DSearch engine queries for the target's domain and common file types
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the PTES methodology, which phase follows the 'Threat Modeling' phase?

   • AReporting
   • BExploitation
   • CPost-Exploitation
   • DVulnerability Analysis
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which activity is a distinguishing characteristic of penetration testing as opposed to a vulnerability assessment?

   • AExploiting a discovered vulnerability to gain unauthorized access
   • BProducing a report that lists vulnerabilities with severity ratings
   • CIdentifying missing security patches on a server
   • DScanning network ports to identify open services
   Reveal Solution Discussion Select an answer first