A penetration test report is being written. The tester found a high-risk vulnerability in a customer-facing application. The report should include a clear remediation recommendation. Which recommendation is most actionable?

Run a vulnerability scan next month

Apply input validation and parameterized queries to prevent SQL injection

Improve overall security posture

A penetration test report includes a finding that a web application is vulnerable to SQL injection. The report lists the affected URL, a proof-of-concept, and a CVSS score of 9.1. Which additional element is most important for the client to prioritize remediation?

The exact HTTP request used in the proof-of-concept

A list of all other vulnerabilities found in the same application

A business-impact statement explaining the potential data exposure

The tester's personal recommendation to use a web application firewall

A penetration tester is conducting a test for a client and discovers that the client's employees are using a third-party cloud service that stores sensitive customer data. The rules of engagement do not include this cloud service. The tester believes that the cloud service has a vulnerability that could expose the data. What is the most ethical and legal action?

Test the cloud service using only passive techniques to avoid detection.

Report the potential vulnerability to the client as an out-of-scope observation without testing it.

Ignore the cloud service because it is out of scope.

Test the cloud service to confirm the vulnerability, then report it to the client.

GIAC Certified Enterprise Defender

Domain 4Objective 1

Penetration Testing Concepts GCED Practice Questions (Page 6)

Part of the Penetration Testing domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 26–30

26application · medium
A penetration test report is being written. The tester found a high-risk vulnerability in a customer-facing application. The report should include a clear remediation recommendation. Which recommendation is most actionable?
Select an answer first
27application · medium
A penetration test report includes a finding that a web application is vulnerable to SQL injection. The report lists the affected URL, a proof-of-concept, and a CVSS score of 9.1. Which additional element is most important for the client to prioritize remediation?
Select an answer first
28expert · hard
A penetration tester is conducting a test for a client and discovers that the client's employees are using a third-party cloud service that stores sensitive customer data. The rules of engagement do not include this cloud service. The tester believes that the cloud service has a vulnerability that could expose the data. What is the most ethical and legal action?
Select an answer first
29application · easy
A company wants to test its external perimeter defenses. The testing team is given no prior knowledge of the network and must discover vulnerabilities from an outsider's perspective. Which testing approach is most appropriate?
Select an answer first
30foundation · easy
In which phase of a penetration test does the tester actively interact with target systems to identify open ports, running services, and potential vulnerabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Penetration Testing Concepts GCED Practice Questions (Page 6)

Questions 26–30

A penetration test report is being written. The tester found a high-risk vulnerability in a customer-facing application. The report should include a clear remediation recommendation. Which recommendation is most actionable?

A penetration test report includes a finding that a web application is vulnerable to SQL injection. The report lists the affected URL, a proof-of-concept, and a CVSS score of 9.1. Which additional element is most important for the client to prioritize remediation?

A company wants to test its external perimeter defenses. The testing team is given no prior knowledge of the network and must discover vulnerabilities from an outsider's perspective. Which testing approach is most appropriate?

In which phase of a penetration test does the tester actively interact with target systems to identify open ports, running services, and potential vulnerabilities?

Keep studying — Penetration Testing