Penetration Testing Concepts GCED Practice Questions (Page 7)

Questions 31–35

1. 31application · easy

   A company wants to assess the security of its network by identifying known vulnerabilities and misconfigurations without attempting to exploit them. The company wants a quick, automated assessment that produces a list of issues with severity ratings. Which type of assessment is most appropriate?

   • APenetration test
   • BSecurity audit
   • CVulnerability scan
   • DRed team exercise
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A penetration tester is hired by a company to test its network. During the test, the tester discovers a database containing personal information of customers. The rules of engagement do not explicitly mention data handling. What is the most ethical and legal course of action?

   • AStop testing and inform the client of the discovery
   • BAnonymize the data before including it in the report
   • CContinue testing and include the data in the report
   • DIgnore the data and continue testing other systems
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A penetration tester has completed the exploitation and post-exploitation phases of an internal network assessment. The rules of engagement require that the final report include a clear risk rating for each finding, but the tester is unsure how to rate a vulnerability that was only exploited in a test environment, not in production. What is the most appropriate approach?

   • AExclude the vulnerability from the report because it was not tested in production.
   • BRate the vulnerability as critical because exploitation was proven, regardless of the environment.
   • CRate the vulnerability as low because it was not exploited in production.
   • DRate the vulnerability based on the potential impact to production, noting that exploitation was confirmed in a test environment.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary legal requirement before conducting a penetration test against an organization's systems?

   • ANotifying law enforcement agencies
   • BRegistering the test with a regulatory body
   • CPurchasing a penetration testing license
   • DObtaining written authorization from the organization
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which document defines the boundaries of a penetration test, including which systems may be targeted, what techniques are allowed, and when the test may be performed?

   • AService Level Agreement (SLA)
   • BIncident Response Plan
   • CRules of Engagement (RoE)
   • DMemorandum of Understanding (MOU)
   Reveal Solution Discussion Select an answer first