Penetration Test Planning GPEN Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   What is the primary purpose of the executive summary in a penetration test report?

   • AProvide a high-level overview of the test's findings and risk level for non-technical stakeholders
   • BShow the exact commands used during the test
   • CProvide a step-by-step remediation guide
   • DList all technical vulnerabilities with detailed exploit steps
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A regional bank hires your firm for a penetration test. The bank's compliance team insists that the test must not disrupt production customer-facing systems, and they want to validate that their internal vulnerability scanner's findings are accurate. The bank provides you with network diagrams, firewall rules, and a list of internal IP ranges, but they do not provide credentials. Which of the following best aligns the test scope and type with the bank's requirements?

   • APerform a white-box test with full credentials and access to all systems, including customer-facing production systems, to ensure complete coverage of the internal network.
   • BPerform a black-box test against the internal IP ranges, using only passive reconnaissance and avoiding any active scanning that could impact production systems.
   • CPerform a black-box test against the internal IP ranges, but include customer-facing systems in the rules of engagement to ensure the test is comprehensive.
   • DPerform a gray-box test against the internal IP ranges, using the provided network diagrams to guide active scanning and exploitation, while excluding customer-facing systems from the rules of engagement.
   Reveal Solution Discussion Select an answer first