Penetration Test Planning GPEN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a measurable success criterion for a penetration test?

   • AThe tester used a variety of tools
   • BThe client received a report
   • CThe tester gained access to the internal network within 48 hours
   • DThe tester followed the rules of engagement
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A penetration tester is assessing a web application that uses a SQL database. Which tool is most appropriate for testing the application for SQL injection vulnerabilities?

   • Asqlmap
   • BMetasploit
   • CNmap
   • DWireshark
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester is planning an engagement for a client that has recently experienced a security breach. The client wants to understand how the breach occurred and whether similar vulnerabilities exist elsewhere in the environment. The client has provided the tester with the attacker's tactics, techniques, and procedures (TTPs) from the breach investigation. The client wants the test to focus on validating whether the same attack path is still viable. Which testing approach is most appropriate?

   • AUse a gray-box testing approach with the provided TTPs to replicate the attack path and validate whether the vulnerabilities are still present.
   • BUse a white-box testing approach with full access to source code and infrastructure to identify all vulnerabilities, not just the attack path from the breach.
   • CUse a black-box testing approach to simulate a new attacker with no prior knowledge, to identify all possible attack paths.
   • DPerform a red-team exercise that includes social engineering and physical security testing to simulate a full-scale attack.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is about to start an engagement for a client. The rules of engagement specify that testing must be limited to business hours (9 AM to 5 PM) and must not include social engineering. The tester has identified a potential social engineering vector that could provide access to the internal network. What is the most appropriate action?

   • APause the engagement and request permission from the client to include social engineering in the test.
   • BUse the social engineering vector outside of business hours to avoid detection and stay within the spirit of the rules.
   • CUse the social engineering vector during business hours, as it is within the allowed time window.
   • DDo not use the social engineering vector and focus on technical testing methods that are within the rules of engagement.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration tester is engaged to assess a client's web application that is hosted in a cloud environment. The client has provided the tester with the application's source code and has requested a test that focuses on the application's business logic. The client has also specified that the test must not affect the production environment and that a test environment is available. Which tool and technique combination is most appropriate for this task?

   • APerform a black-box test against the test environment without using the source code, to simulate an external attacker.
   • BUse a network vulnerability scanner to identify infrastructure-level vulnerabilities in the cloud environment.
   • CUse a combination of static analysis of the source code and dynamic testing against the test environment, focusing on business logic flaws.
   • DUse a web application scanner against the production environment to identify common vulnerabilities, including business logic flaws.
   Reveal Solution Discussion Select an answer first