Penetration Testing Concepts GCED Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During a penetration test, a tester discovers sensitive employee data on a compromised server. What is the ethical obligation of the tester regarding this data?

   • ACopy all data to a secure location for further analysis
   • BMinimize exposure and include only necessary evidence in the report
   • CShare the data with other team members to verify the finding
   • DDelete the data to prevent further exposure
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During a penetration test, the tester discovers a critical vulnerability in a system that is not listed in the rules of engagement. The system is in the same network segment as the authorized targets, and the vulnerability could be exploited to compromise the entire network. The client has not authorized testing on this system. What is the most appropriate action?

   • AStop testing and immediately inform the client of the out-of-scope finding.
   • BTest the system only with passive techniques to avoid causing harm.
   • CExploit the vulnerability to demonstrate the impact, then report it.
   • DContinue testing the authorized targets and include the out-of-scope finding in the final report.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A penetration tester is writing a report for a client. The client is a small business with limited technical staff. The report needs to be useful for both management and IT staff. What is the best way to structure the report?

   • AProvide the raw scan results and let the client interpret them.
   • BProvide a report with an executive summary for management and a technical appendix for IT staff.
   • CProvide only a high-level summary of findings without technical details.
   • DProvide a single, highly technical report with detailed exploit steps and code.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is performing a gray-box test of a web application. The tester has valid credentials for a standard user but not for an administrator. During the scanning phase, the tester discovers an endpoint that appears to be an admin panel. What is the most appropriate next step?

   • AAttempt to access the admin panel using the standard user credentials
   • BTry to brute-force the admin password
   • CIgnore the admin panel and test other features
   • DStop testing and report the admin panel as a finding
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration testing team is choosing a methodology for a comprehensive assessment that includes both network and web application testing. They need a methodology that provides detailed technical procedures and is widely recognized. Which methodology is the best fit?

   • APTES
   • BOWASP Testing Guide
   • CISSAF
   • DOSSTMM
   Reveal Solution Discussion Select an answer first