Penetration Test Planning GPEN Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation with offices in multiple countries wants to test its global network. The corporation is subject to data residency laws that require certain data to remain in specific countries. The test will involve scanning and exploitation of systems in multiple regions. Which of the following is the most important consideration when defining the scope of the test?

   • AEnsuring that the testers are located in the same country as the systems being tested to avoid cross-border data transfer issues.
   • BEnsuring that the rules of engagement specify which data can be accessed and stored, and that the testers comply with local data residency laws.
   • CEnsuring that the test is performed during off-peak hours in each region to minimize the impact on business operations.
   • DEnsuring that the test is performed as a black-box test to minimize the amount of data exposed to the testers.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare organization wants to validate that its newly deployed internal EHR system is resistant to attacks from a malicious insider who has valid low-privileged domain credentials and knows the system's architecture from the vendor documentation. The organization wants the test to focus on what an authenticated user could access or escalate to, rather than on external discovery. Which testing approach and toolset best fits this requirement?

   • ARed-team style testing that combines external reconnaissance with social engineering to gain initial access, then pivots internally to the EHR system.
   • BBlack-box testing from an unauthenticated external position using network enumeration and public exploit frameworks to identify reachable services.
   • CGray-box testing with partial credentials and no architectural documentation, relying on fuzzing and dynamic analysis to discover vulnerabilities.
   • DWhite-box testing using credentialed vulnerability scanning and manual exploitation attempts from a low-privileged domain account, focusing on privilege escalation paths.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is leading an engagement for a financial services client. The client has requested a test that focuses on the external perimeter and internal network segmentation. The tester has completed the reconnaissance phase and is about to begin scanning. Which sequence of actions best aligns with a structured penetration testing methodology?

   • AConduct internal network scanning first, then external perimeter scanning, and finish with exploitation and reporting.
   • BPerform active scanning of the external perimeter, then move to internal network scanning, followed by exploitation of identified vulnerabilities, and finally document findings in a report.
   • CBegin with exploitation of known vulnerabilities from the reconnaissance phase, then scan for additional targets, and compile the report at the end.
   • DScan the external perimeter, exploit any found vulnerabilities, then scan the internal network, and finally report the results.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is engaged to assess a web application that uses a modern JavaScript framework with a REST API backend. The client has provided the application's source code and API documentation. The tester needs to identify vulnerabilities in the application's authentication and authorization logic. Which tool and technique combination is most appropriate for this task?

   • APerform a black-box test using only a web proxy to manually intercept and modify requests without any prior knowledge of the application.
   • BRun a network vulnerability scanner against the web server to identify common misconfigurations and known CVEs.
   • CUse a fuzzing tool to send random data to the API endpoints and observe for crashes or unexpected behavior.
   • DUse a web application security scanner configured with the provided API documentation and source code to perform authenticated scanning and manual testing of authorization flaws.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During the scoping phase of a penetration test, the client states that the engagement must not include any social engineering attempts and must be limited to the IP range 192.168.10.0/24. Which document should explicitly capture these constraints before testing begins?

   • ARules of engagement
   • BVulnerability assessment report
   • CIncident response plan
   • DPenetration test proposal
   Reveal Solution Discussion Select an answer first