Penetration Testing Application GCED Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is performing reconnaissance on a target organization. The tester has identified an employee's email address from a public breach database and found a personal blog where the employee discusses their work projects. The tester wants to use this information to craft a targeted attack. Which technique is the tester applying?

   • AVulnerability identification by running a port scan on the target's network.
   • BPost-exploitation by using the employee's credentials to access internal systems.
   • CActive reconnaissance by scanning the employee's personal blog for vulnerabilities.
   • DPassive reconnaissance by collecting publicly available information about the employee.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which penetration testing methodology is specifically focused on web application security and is widely used for testing web applications?

   • ANIST SP 800-115
   • BPTES
   • COWASP Testing Guide
   • DOSSTMM
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A penetration tester has completed an assessment and identified a critical vulnerability in a customer's web application. The customer's development team is asking for a detailed explanation of the vulnerability and how to fix it. Which section of the penetration testing report should the tester prioritize?

   • AScope and limitations section outlining what was tested
   • BTechnical findings with proof-of-concept and remediation recommendations
   • CExecutive summary with business impact and risk ratings
   • DMethodology section describing the testing approach
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of exploitation techniques in a penetration test?

   • ATo identify open ports on the target
   • BTo enumerate the target's operating system and services
   • CTo gain unauthorized access to a system by leveraging a vulnerability
   • DTo create a report of vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the goal of privilege escalation in post-exploitation?

   • ATo cover tracks and remove logs
   • BTo maintain persistence on the compromised system
   • CTo gain higher-level permissions than initially obtained
   • DTo move laterally to other systems
   Reveal Solution Discussion Select an answer first