Penetration Test Planning GPEN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A penetration tester is contracted to test a client's external web application. The client explicitly states that the tester must not access the underlying database server or any internal network segments. What is the most appropriate way to document this restriction?

   • AIgnore the restriction because it is not a technical constraint
   • BInclude the restriction in the rules of engagement
   • CRely on verbal agreement with the client
   • DNote the restriction in the final report only
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A penetration tester is leading an engagement for a client that has a complex network with multiple segments and a mix of legacy and modern systems. The client has requested a test that provides a comprehensive assessment of the network's security posture. The tester has a limited budget and must prioritize the test phases to maximize the value of the assessment. Which approach best balances the need for comprehensive coverage with the budget constraint?

   • AFocus on exploitation of the most critical systems first, and skip the scanning phase to save time and budget.
   • BPerform a full exploitation of all identified vulnerabilities, regardless of the time and budget required.
   • CFocus on the reporting phase and provide a comprehensive report based on the tester's experience, without performing active testing.
   • DPrioritize the scanning phase to identify as many vulnerabilities as possible across all segments, then focus exploitation efforts on the most critical systems.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a rules of engagement document, which element is essential to include to ensure that testing is performed only during authorized periods?

   • AEmergency contact list
   • BReporting format
   • CTesting window
   • DTarget IP addresses
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is engaged by a regional bank to assess its internet-facing web application and API endpoints. The bank's legal team has specified that testing must not exceed 10 requests per second per source IP, must occur only between 2:00 AM and 6:00 AM local time, and must exclude the third-party payment processor's API. The tester has completed reconnaissance and is about to begin active scanning. Which action best aligns with the established constraints?

   • ARun the scan at the default tool speed but pause it if any request returns a 429 or 503 response, and manually skip the payment processor's endpoints if discovered.
   • BConfigure the scanning tool with a global rate limit of 10 requests per second and schedule the scan window to run during the approved hours, excluding the payment processor's domain from the target list.
   • CUse a distributed scanning setup with multiple source IPs to effectively bypass the per-IP rate limit and complete the scan faster within the allowed time window.
   • DPerform the scan only against the web application and defer API testing until the bank's legal team can confirm whether the payment processor's API is in scope.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of the reconnaissance phase in a penetration test?

   • ADocument findings and remediation steps
   • BExploit identified vulnerabilities to gain access
   • CScan for open ports and services
   • DGather information about the target without actively attacking it
   Reveal Solution Discussion Select an answer first