Vulnerability Scanning and Penetration Testing GSEC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is asked to assess the security of a new web application. The client provides the tester with the application's source code and architecture diagrams. The tester's goal is to identify as many vulnerabilities as possible in a limited time. What type of penetration test is this?

   • ABlack-box penetration test
   • BExternal penetration test
   • CGray-box penetration test
   • DWhite-box penetration test
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company wants to test its security controls against a realistic external attacker. The test should not reveal the target systems or network topology to the testers. However, the testers need some information to avoid wasting time on non-existent systems. Which type of penetration test is most appropriate?

   • AWhite-box penetration test
   • BGray-box penetration test
   • CVulnerability scan
   • DBlack-box penetration test
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it essential to obtain written authorization before conducting a vulnerability scan or penetration test?

   • ATo protect the tester from legal liability and ensure the activity is lawful
   • BTo ensure the tester has the necessary technical skills
   • CTo guarantee that no vulnerabilities will be exploited
   • DTo allow the tester to bypass security controls
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A penetration tester is conducting a gray-box test of a client's internal network. The client has provided credentials for a standard user account. During the test, the tester discovers a critical vulnerability that could be exploited to gain domain admin access. The tester has not yet attempted the exploit. The client has asked for a preliminary report. What should the tester do?

   • AInclude the vulnerability in the final report without mentioning it now
   • BReport the vulnerability with a recommendation to remediate immediately, and ask for permission to attempt the exploit
   • CAttempt the exploit to confirm the impact before reporting
   • DStop the test and refuse to continue until the client signs a new agreement
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which phase of the penetration testing process involves gathering information about the target from public sources such as DNS records, social media, and search engines?

   • AReconnaissance
   • BScanning
   • CExploitation
   • DReporting
   Reveal Solution Discussion Select an answer first