A company wants to assess the security of its custom web application before a major release. The security team has limited time and budget, and the application is already in production. The team needs to identify exploitable vulnerabilities in the application's business logic and input handling. Which methodology is most appropriate?

Use OSSTMM to evaluate operational security metrics without performing any exploitation.

Perform a network penetration test focusing on firewall and router configurations.

Run an automated vulnerability scanner and fix all findings without manual verification.

Conduct a full penetration test following the PTES methodology, including all phases from pre-engagement to reporting.

Which of the following is an example of passive reconnaissance?

Browsing the target's public website and social media profiles

Using a vulnerability scanner to identify weaknesses in the target

Sending crafted HTTP requests to a web server to identify the server software

Using Nmap to scan a target network for open ports

What is the primary goal of a penetration test compared to a vulnerability scan?

To enumerate all software versions and patch levels on a target network

To validate the exploitability of vulnerabilities and demonstrate the real-world impact of a compromise

To provide a compliance checklist of security controls that must be implemented

To identify all potential vulnerabilities without attempting to exploit them

Which technique is considered active reconnaissance?

Searching DNS records for a domain

Performing a port scan on the target's firewall

Reviewing the target's annual report

Reading the target's job postings

During a penetration test, a tester finds that a web application is vulnerable to SQL injection in the search parameter. The tester wants to demonstrate the impact by retrieving data from the database. Which action is most appropriate?

Document the vulnerability without further exploitation.

Run a denial-of-service attack against the database server.

Use a UNION-based SQL injection to extract data from other tables.

Patch the application code to fix the SQL injection.

GIAC Certified Enterprise Defender

Domain 4Objective 2

Penetration Testing Application GCED Practice Questions (Page 5)

Part of the Penetration Testing domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21application · medium
A company wants to assess the security of its custom web application before a major release. The security team has limited time and budget, and the application is already in production. The team needs to identify exploitable vulnerabilities in the application's business logic and input handling. Which methodology is most appropriate?
Select an answer first
22foundation · easy
Which of the following is an example of passive reconnaissance?
Select an answer first
23foundation · easy
What is the primary goal of a penetration test compared to a vulnerability scan?
Select an answer first
24foundation · easy
Which technique is considered active reconnaissance?
Select an answer first
25application · medium
During a penetration test, a tester finds that a web application is vulnerable to SQL injection in the search parameter. The tester wants to demonstrate the impact by retrieving data from the database. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.