Welcome to the Planning and Scoping Penetration Tests MCQs Page

Dive deep into the fascinating world of Planning and Scoping Penetration Tests with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Planning and Scoping Penetration Tests, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Planning and Scoping Penetration Tests, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Planning and Scoping Penetration Tests. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Planning and Scoping Penetration Tests. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Planning and Scoping Penetration Tests MCQs | Page 11 of 12

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Penetration Testing

02

Information Gathering 🔒

03

Vulnerability Scanning 🔒

04

Analyzing Vulnerability Scans

05

Exploiting and Pivoting 🔒

06

Exploiting Network Vulnerabilities 🔒

07

Exploiting Physical and Social Vulnerabilities

08

Exploiting Application Vulnerabilities 🔒

09

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

10

Reporting and Communication

11

Scripting for Penetration Testing 🔒

Q101.

Maria wants to build a penetration testing process for her organization and intends to start with an existing standard or methodology. Which of the following is not suitable for that purpose?

ISSAF

OSSTM

PTES

ATT&CK

Discuss

Answer: (d).ATT&CK Explanation:PTES, OSSTMM, and ISSAF are all penetration testing methodologies or standards. MITRE’s ATT&CK framework describes adversary tactics and techniques but does not outline how to perform a penetration test.

Q102.

Which of the following types of penetration test would provide testers with complete visibility into the configuration of a web server without having to compromise the server to gain that information?

Unknown environment

Partial knowledge

Known environment

Zero knowledge

Discuss

Answer: (c).Known environment Explanation:Known environment testing, often also known as “crystal box” or “white box” testing, provides complete access and visibility. Unknown environment, or black-box testing, provides no information, whereas partial knowledge, or gray-box testing, provides limited information.

Q103.

What type of legal agreement typically covers sensitive data and information that a penetration tester may encounter while performing an assessment?

A noncompete

An NDA

A data security agreement

A DSA

Discuss

Answer: (b).An NDA Explanation:A nondisclosure agreement, or NDA, covers the data and other information that a penetration tester may encounter or discover during their work. It acts as a legal agreement preventing disclosure of that information.

Q104.

During a penetration test scoping discussion, Charles is asked to test the organization’s SaaS-based email system. What concern should he bring up?

Cloud-based systems require more time and effort.

Determining the scope will be difficult due to the size of cloud-hosted environments.

Cloud service providers do not typically allow testing of their services.

Testing cloud services is illegal.

Discuss

Answer: (c).Cloud service providers do not typically allow testing of their services. Explanation:Cloud service providers don’t typically allow testing to be conducted against their services. Charles may recommend that the company ask for third-party security audit information instead. Cloud systems and large environments can be difficult to scope and may require more time, but the primary issue here is the ability to even legitimately conduct the assessment that is being requested.

Q105.

During a penetration test, Alex discovers that he is unable to scan a server that he was able to successfully scan earlier in the day from the same IP address. What has most likely happened?

His IP address was whitelisted.

The server crashed.

The network is down.

His IP address was blacklisted.

Discuss

Answer: (d).His IP address was blacklisted. Explanation:The IP address or network that Alex is sending his traffic from was most likely blacklisted as part of the target organization’s defensive practices. A whitelist would allow him in, and it is far less likely that the server or network has gone down.

Q106.

What does an MSA typically include?

The terms that will govern future agreements

Mutual support during assessments

Microservices architecture

The minimum service level acceptable

Discuss

Answer: (a).The terms that will govern future agreements Explanation:A master service agreement (MSA) is a contract that defines the terms under which future work will be completed. Specific work is then typically handled under a statement of work (SOW).

Q107.

While performing an on-site penetration test, Cassandra plugs her laptop into an accessible network jack. When she attempts to connect, however, she does not receive an IP address and gets no network connectivity. She knows that the port was working previously. What technology has her target most likely deployed?

Jack whitelisting

Jack blacklisting

NAC

802.15

Discuss

Answer: (c).NAC Explanation:The organization that Cassandra is testing has likely deployed network access control (NAC). Her system will not have the proper NAC client installed, and she will be unable to access that network jack without authenticating and having her system approved by the NAC system.

Q108.

What type of penetration test is not aimed at identifying as many vulnerabilities as possible and instead focuses on vulnerabilities that specifically align with the goals of gaining control of specific systems or data?

An objectives-based assessment

A compliance-based assessment

A black-team assessment

A red-team assessment

Discuss

Answer: (a).An objectives-based assessment Explanation:An objectives-based assessment specifically targets goals like gaining access to specific systems or data. A compliance-based assessment focuses on whether systems are properly secured or meet standards. A red-team assessment simulates an actual attack, maximizing access rather than comprehensively identifying all vulnerabilities. Black-team assessments are not a commonly used penetration testing term.

Q109.

During an on-site penetration test, what scoping element is critical for wireless assessments when working in shared buildings?

Encryption type

Wireless frequency

SSIDs

Preshared keys

Discuss

Answer: (c).SSIDs Explanation:Knowing the SSIDs that are in scope is critical when working in shared buildings. Penetrating the wrong network could cause legal or even criminal repercussions for a careless penetration tester!

Q110.

Ruchika has been asked to conduct a penetration test against internal business systems at a mid-sized company that operates only during a normal day shift. The test will be run against critical business systems. What restriction is most likely to be appropriate for the testing?

Time of day

Types of allowed tests

Types of prohibited tests

The physical locations that can be tested

Discuss

Answer: (a).Time of day Explanation:Time-of-day restrictions can be used to ensure tests occur when the systems are not in use, allowing time for recovery or restoration if something goes wrong. Types of allowed tests or denied tests are less likely to be used since they can limit the value of a test, and restricting physical locations is uncommon for smaller organizations that don’t have many distinct locations.

Page 11 of 12

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Planning and Scoping Penetration Tests MCQs Page

Planning and Scoping Penetration Tests MCQs | Page 11 of 12

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Penetration Testing

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Reporting and Communication

Suggested Topics

HTML

Cryptography and Network Security

Python

MS Office

MongoDB

Compiler Design

UNIX

Embedded Systems

Hadoop