Q. What is scope creep in the context of penetration tests?

View solution

Q. What is the recommended action to handle scope creep during a penetration test?

View solution

Q. How can internal knowledgebase articles support penetration testers?

View solution

Q. What information can be found in configuration files that is valuable for penetration testers?

View solution

Q. Why is understanding the use of software development kits (SDKs) important for penetration testers?

View solution

Q. What is a common security exception for known environment tests?

View solution

Q. What does certificate pinning associate a host with?

View solution

Q. What role does access to user accounts and privileged accounts play in penetration tests?

View solution

Q. What is one of the most powerful tools a penetration tester can have?

View solution

Q. Why is network access important for penetration testers?

View solution

Q. What determines the budget required for a penetration test?

View solution

Q. For external or commercial testers, what might the budget for a penetration test include?

View solution

Q. Which framework provides a knowledgebase of adversary tactics and techniques, including details of mitigations, threat actor groups, and software?

View solution

Q. What does the Open Web Application Security Project (OWASP) provide guides for?

View solution

Q. Which penetration testing standard covers pre-engagement interactions, scoping, and details such as dealing with third parties?

View solution

Q. What does the MITRE ATT&CK Framework stand for?

View solution

Q. What should be considered when using dated penetration testing standards?

View solution

Q. Which penetration testing methodology guide covers analysis, metrics, workflows, human security, physical security, and wireless security but has not been updated since 2010?

View solution

Q. Which organization provides standards that include penetration testing as part of NIST special publication 800-115?

View solution

Q. What is the last update year for the Information Systems Security Assessment Framework (ISSAF)?

View solution