Penetration Testing Concepts GCED Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company wants to understand the real-world impact of a recently discovered vulnerability in its web application. The company has already run a vulnerability scanner and confirmed the vulnerability exists. What is the next step to determine the actual business risk?

   • AReview the vulnerability scanner's report and assign a risk rating based on the CVSS score.
   • BConduct a penetration test to attempt to exploit the vulnerability and assess the impact.
   • CPatch the vulnerability immediately without further testing.
   • DRun another vulnerability scan with a different tool to confirm the finding.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A company has a mature security program and regularly conducts vulnerability scans. The company now wants to test its incident response capabilities by simulating a realistic attack. The test should be unannounced to the security team and should include attempts to evade detection. Which type of assessment is most appropriate?

   • ARed team exercise
   • BVulnerability scan
   • CPenetration test
   • DSecurity audit
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   A penetration tester is given network diagrams, source code, and valid credentials before starting the test. Which type of penetration test is this?

   • AGray-box
   • BWhite-box
   • CExternal
   • DBlack-box
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In which type of penetration test does the tester have no prior knowledge of the target environment, simulating an external attacker?

   • ABlack-box
   • BGray-box
   • CRed-team
   • DWhite-box
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A penetration tester is hired to test a company's network. The rules of engagement include a clause that the tester must not access or exfiltrate personal data. During the test, the tester gains access to a file share that contains a file named 'customer_data.xlsx'. What should the tester do?

   • ANote the file's existence and do not open it
   • BCopy the file to the test report as evidence
   • CDelete the file to protect the data
   • DOpen the file to determine if it contains personal data
   Reveal Solution Discussion Select an answer first