Welcome to the Penetration Testing MCQs Page

Dive deep into the fascinating world of Penetration Testing with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Penetration Testing, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Penetration Testing, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Penetration Testing. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Penetration Testing. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Penetration Testing MCQs | Page 8 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Planning and Scoping Penetration Tests 🔒

02

Information Gathering 🔒

03

Vulnerability Scanning 🔒

04

Analyzing Vulnerability Scans

05

Exploiting and Pivoting 🔒

06

Exploiting Network Vulnerabilities 🔒

07

Exploiting Physical and Social Vulnerabilities

08

Exploiting Application Vulnerabilities 🔒

09

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

10

Reporting and Communication

11

Scripting for Penetration Testing 🔒

Q71.

In which phase of the penetration testing process do testers share their findings with the target organization?

Information Gathering and Vulnerability Scanning

Attacking and Exploiting

Planning and Scoping

Reporting and Communicating Results

Discuss

Answer: (d).Reporting and Communicating Results Explanation:Testers share their findings with the target organization during the Reporting and Communicating Results phase of the penetration testing process.

Q72.

Tom is running a penetration test in a web application and discovers a flaw that allows him to shut down the web server remotely. What goal of penetration testing has Tom most directly achieved?

Disclosure

Integrity

Alteration

Denial

Discuss

Answer: (d).Denial Explanation:Tom’s attack achieved the goal of denial by shutting down the web server and preventing legitimate users from accessing it.

Q73.

Brian ran a penetration test against a school’s grading system and discovered a flaw that would allow students to alter their grades by exploiting a SQL injection vulnerability. What type of control should he recommend to the school’s cybersecurity team to prevent students from engaging in this type of activity?

Confidentiality

Integrity

Alteration

Availability

Discuss

Answer: (b).Integrity Explanation:By allowing students to change their own grades, this vulnerability provides a pathway to unauthorized alteration of information. Brian should recommend that the school deploy integrity controls that prevent unauthorized modifications.

Q74.

Edward Snowden gathered a massive quantity of sensitive information from the National Security Agency and released it to the media without permission. What type of attack did he wage?

Disclosure

Denial

Alteration

Availability

Discuss

Answer: (a).Disclosure Explanation:Snowden released sensitive information to individuals and groups who were not authorized to access that information. That is an example of a disclosure attack.

Q75.

Assuming no significant changes in an organization’s cardholder data environment, how often does PCI DSS require that a merchant accepting credit cards conduct penetration testing?

Monthly

Semiannually

Annually

Biannually

Discuss

Answer: (c).Annually Explanation:PCI DSS requires that organizations conduct both internal and external penetration tests on at least an annual basis. Organizations must also conduct testing after any significant change in the cardholder data environment.

Q76.

Which one of the following is not a benefit of using an internal penetration testing team?

Contextual knowledge

Cost

Subject matter expertise

Independence

Discuss

Answer: (d).Independence Explanation:The use of internal testing teams may introduce conscious or unconscious bias into the penetration testing process. This lack of independence is one reason organizations may choose to use an external testing team.

Q77.

Which one of the following is not a reason to conduct periodic penetration tests of systems and applications?

Changes in the environment

Cost

Evolving threats

New team members

Discuss

Answer: (b).Cost Explanation:Repeating penetration tests periodically does not provide cost benefits to the organization. In fact, it incurs costs. However, penetration tests should be repeated because they can detect issues that arise due to changes in the tested environment and the evolving threat landscape. The use of new team members also increases the independence and value of subsequent tests.

Q78.

Rich recently got into trouble with a client for using an attack tool during a penetration test that caused a system outage. During what stage of the penetration testing process should Rich and his clients have agreed on the tools and techniques that he would use during the test?

Planning and Scoping

Information Gathering and Vulnerability Scanning

Attacking and Exploiting

Reporting and Communication Results

Discuss

Answer: (a).Planning and Scoping Explanation:During the Planning and Scoping phase, penetration testers and their clients should agree on the rules of engagement for the test. This should result in a written statement of work that clearly outlines the activities authorized during the penetration test.

Q79.

Which one of the following steps of the Cyber Kill Chain does not map to the Attacking and Exploiting stage of the penetration testing process?

Weaponization

Reconnaissance

Installation

Actions on Objectives

Discuss

Answer: (b).Reconnaissance Explanation:The Reconnaissance stage of the Cyber Kill Chain maps to the Information Gathering and Vulnerability Scanning step of the penetration testing process. The remaining six steps of the Cyber Kill Chain all map to the Attacking and Exploiting phase of the penetration testing process.

Q80.

Beth recently conducted a phishing attack against a penetration testing target in an attempt to gather credentials that she might use in later attacks. What stage of the penetration testing process is Beth in?

Planning and Scoping

Attacking and Exploiting

Information Gathering and Vulnerability Scanning

Reporting and Communication

Discuss

Answer: (b).Attacking and Exploiting Explanation:While Beth is indeed gathering information during a phishing attack, she is conducting an active social engineering attack. This moves beyond the activities of Information Gathering and Vulnerability Scanning and moves into the realm of Attacking and Exploiting.

Page 8 of 10

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Penetration Testing MCQs Page

Penetration Testing MCQs | Page 8 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Reporting and Communication

Suggested Topics

MongoDB

JavaScript

Data Science

C# programming

Python

MySQL Database

Human Computer Interaction

Digital Image Processing (DIP)

Management Information Systems