Which statement best describes the primary purpose of a penetration test?

To ensure compliance with regulatory standards

To validate that security controls are effective by safely exploiting vulnerabilities

To enumerate all software versions installed on a network

To identify all possible vulnerabilities in an application

A penetration test is scheduled for a production environment. The rules of engagement state that no testing is allowed between 9 AM and 5 PM local time. During the test, the tester discovers a critical vulnerability that could be exploited to gain immediate access. What should the tester do?

Ask the client for verbal permission to continue

Exploit the vulnerability immediately to prevent data loss

Wait until the next allowed testing window to continue

Document the vulnerability and continue testing other systems

GIAC Certified Enterprise Defender

Domain 4Objective 1

Penetration Testing Concepts GCED Practice Questions (Page 5)

Part of the Penetration Testing domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 21–25

21application · medium
A company hires an external firm to test its public-facing web application. The contract specifies that the testers may only target the production environment during off-peak hours, must not use denial-of-service techniques, and must provide a list of all IP addresses they will use. Which document most directly defines these constraints?
Select an answer first
22foundation · easy
Which statement best describes the primary purpose of a penetration test?
Select an answer first
23foundation · easy
Which section of a penetration testing report provides a high-level summary of the test's objectives, overall results, and key findings for management?
Select an answer first
24application · medium
A penetration test is scheduled for a production environment. The rules of engagement state that no testing is allowed between 9 AM and 5 PM local time. During the test, the tester discovers a critical vulnerability that could be exploited to gain immediate access. What should the tester do?
Select an answer first
25application · easy
A penetration tester is asked to assess a new application. The client provides the tester with valid user credentials for a standard user account, but no other information about the system. The goal is to identify vulnerabilities that an authenticated user could exploit. Which testing approach is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Penetration Testing Concepts GCED Practice Questions (Page 5)

Questions 21–25

Which statement best describes the primary purpose of a penetration test?

Which section of a penetration testing report provides a high-level summary of the test's objectives, overall results, and key findings for management?

A penetration test is scheduled for a production environment. The rules of engagement state that no testing is allowed between 9 AM and 5 PM local time. During the test, the tester discovers a critical vulnerability that could be exploited to gain immediate access. What should the tester do?

Keep studying — Penetration Testing