CompTIA PenTest+ Practice Test Chapter 1 Planning and Scoping (Sybex: Panek, Crystal, Tracy) Flashcards
You have been asked to perform a penetration test for a medium-sized organization that sells after-market motorcycle parts online. What is the first task you should complete?
A.Research the organization’s product offerings. B.Determine the budget available for the test.
C.Identify the scope of the test.
D.Gain authorization to perform the test.
C.Identify the scope of the test.
Explanation:
The first step in the penetration testing process is to work with the client to clearly define the scope of the test. The scope determines what penetration testers will do and how their time will be spent. Researching the organization’s products is a task that will probably be done after the scope of work has been defined. Determining the budget and gaining authorization are subtasks that are usually completed as a part of the overall scoping process.
A consultant has been hired to perform a penetration test for an organization. The target of the test is the organization’s proprietary design documents. The aim is to circumvent security measures and gain unauthorized access to these documents. What type of assessment is being conducted in this scenario? A.Objective-based assessment B.Goal-based assessment C.Compliance-based assessment D.Red team assessment
D.Red team assessment
Explanation:
Red team assessments are typically more targeted than normal penetration tests. The red team acts like an attacker, targeting sensitive data or systems with the goal of acquiring access. Goal-based or objective-based assessments are usually designed to assess the overall security of an organization.
Compliance-based assessments are designed to test compliance with specific laws.
A consultant has been hired to perform a penetration test for an organization in the healthcare industry. The target of the test is a public-facing self-service website that users can access to view their health records. The aim is to circumvent security measures and gain unauthorized access to this information. What type of assessment is being conducted in this scenario?
A.Objective-based assessment
B.Gray box assessment
C.Compliance-based assessment
D.White box assessment
C.Compliance-based assessment
Explanation:
Because patient records are protected by the HIPPA law in the United States, this is an example of a compliance assessment.
Compliance-based assessments are designed to test compliance with specific laws. Objective-based assessments are usually designed to assess the overall security of an organization.
Gray box and white box assessments identify the level of knowledge the attacker has of the organization.
A consultant has been hired to perform a penetration test for an organization in the healthcare industry. The target of the test is a public-facing self-service website that users can access to view their health records. The penetration tester has been given full knowledge of the organization’s underlying network. What type of test is being conducted in this example?
A.Goal-based assessment
B.Black box assessment
C.Objective-based assessment
D.White box assessment
D.White box assessment
Explanation:
A white box test is performed with full knowledge of the underlying technology, configuration, and settings of the target organization’s network. In a black box test, the testers are not provided with access to or information about the target environment. Goals-based or objective-based assessments are usually designed to assess the overall security of an organization.
In which type of penetration test does the tester have a limited amount of information about the target environment but is not granted full access?
A.Gray box assessment
B.Black box assessment
C.Compliance-based assessment
D.White box assessment
A.Gray box assessment
Explanation:
A gray box test may provide some information about the environment to the penetration testers without giving full access, credentials, or configuration details. A white box test is performed with full knowledge of the underlying network. In a black box test, the testers are not provided with access to or information about the target environment. Compliance-based assessments are designed to test compliance with specific laws.
Which type of penetration test best replicates the perspective of a real-world attacker?
A.Gray box assessment
B.Black box assessment
C.Objective-based assessment
D.White box assessment
B.Black box assessment
Explanation:
Black box tests are sometimes called zero knowledge tests because they replicate what a typical external attacker would encounter. Testers are not provided with any access or information. A white box test is performed with full knowledge of the underlying network. A gray box test may provide some information about the environment to the penetration testers without giving full access. Objective-based assessments are usually designed to assess the overall security of an organization.
A consultant has been hired by an organization to perform a penetration test. The target of the test is the organization’s HR database application. The tester has been given a desk, a computer connected to the organization’s network, and a network diagram. However, the tester has not been given any authentication credentials.
What type of test is being conducted in this scenario?
A.Compliance-based assessment
B.Black box assessment
C.Gray box assessment
D.White box assessment
C.Gray box assessment
Explanation:
A gray box test may provide some information about the environment to the penetration testers without giving full access, credentials, or configuration details. Compliance-based assessments are designed to test compliance with specific laws. In a black box test, the testers are not provided with access to or information about the target environment. A white box test is performed with full knowledge of the underlying network.
A consultant has been hired by an organization to perform a penetration test. The target of the test is the organization’s e-commerce website. The tester, located in a different city, will utilize several different penetration testing tools to analyze the site
and attack it. The tester does not have any information about the site or any authentication credentials.
What type of test is being conducted in this scenario?
A.White box assessment
B.Black box assessment
C.Objective-based assessment
D.Gray box assessment
B.Black box assessment
Explanation:
In a black box test, testers are not provided with any access to or information about the target. A white box test is performed with full knowledge of the underlying network. A gray box test may provide some information about the environment to the penetration testers without giving full access. Objective-based assessments are usually designed to assess the overall security of an organization.
A consultant has been hired by an organization to perform a penetration test. The target of the test is the organization’s internal firewalls. The tester has been given a desk, a computer connected to the organization’s network, and a network diagram. The tester has also been given authentication credentials with a fairly high level of access. What type of test is being conducted in this scenario?
A.Gray box assessment
B.Black box assessment
C.Goals-based assessment
D.White box assessment
D.White box assessment
Explanation:
A white box test is performed with full knowledge of the underlying technology, configuration, and settings of the target organization’s network. A gray box test may provide some information about the environment to the penetration testers without giving full access. In a black box test, the testers are not provided with access to or information about the target environment. Goals-based or objective-based assessments are usually designed to assess the overall security of an organization.
Which type of penetration test best focuses the tester’s time and efforts while still providing an approximate view of what a real attacker would see?
A.Gray box assessment
B.Black box assessment
C.Goals-based assessment
D.White box assessment
A.Gray box assessment
Explanation:
A gray box test is a blend of black box and white box testing. A gray box test usually provides limited information about the target to the penetration testers but does not provide full access, credentials, or configuration information. A gray box test can help focus penetration testers’ time and effort while also providing a more accurate view of what an attacker would actually encounter. In a black box test, the testers are not provided with access to or information about the target environment. Goals-based or objective-based assessments are usually designed to assess the overall security of an organization. A white box test is performed with full knowledge of the underlying network.
An attacker downloads the Low Orbit Ion Cannon from the Internet and then uses it to conduct a denial-of-service attack against a former employer’s website. What kind of attacker is this?
A.Script kiddie
B.Hacktivist
C.Organized crime
D.Nation-state
A.Script kiddie
Explanation:
A script kiddie is an individual who carries out an attack using code written by more advanced hackers. A hacktivist’s attacks are usually politically motivated. Organized crime actors are usually a highly organized group of cybercriminals whose main goal is to make a lot of money. A nation-state threat actor acts on behalf of a nation to inflict harm on a rival nation.`
An attacker carries out an attack against a government contractor in a neighboring country, with the goal of gaining access through the contractor to the rival country’s governmental network infrastructure. The government of the attacker’s own country is directing and funding the attack.
What type of threat actor is this?
A.Script kiddie
B.Hacktivist
C.Organized crime
D.Nation-state
D.Nation-state
Explanation:
A state-sponsored attacker usually operates under the direction of a government agency. The attacks are usually aimed at government contractors or even the government systems themselves. A script kiddie is an individual who carries out an attack using code written by more advanced hackers. A hacktivist’s attacks are usually politically motivated. An organized crime threat actor is a group of cybercriminals whose main goal is financial gain.
A group of hackers located in a former Soviet-bloc nation have banded together and released a ransomware app on the Internet. Their goal is to extort money in the form of crypto currency from their victims.
What kind of attacker is this?
A.Malicious insider
B.Hacktivist
C.Organized crime
D.Nation-state
C.Organized crime
Explanation:
An organized crime threat actor is a group of cybercriminals whose main goal is financial gain. Attacks carried out by organized crime groups can last a long time, are very well-funded, and are usually quite sophisticated. A malicious insider attack occurs when someone within the organization uses the credentials they have been legitimately given to carry out an attack. A hacktivist’s attacks are usually politically motivated. A nation-state threat actor acts on behalf of a nation to inflict harm on a rival nation.
An attacker who is a passionate advocate for brine shrimp attacks and defaces the website of a company that harvests brine shrimp and sells them as fish food.
What type of attacker is this?
A.Script kiddie
B.Hacktivist
C.Organized crime
D.Nation-state
B.Hacktivist
Explanation:
A hacktivist’s attacks are usually politically motivated, instead of financially motivated. Typically, they want to expose perceived corruption or gain attention for their cause. A script kiddie is an individual who carries out an attack using code written by more advanced hackers. An organized crime threat actor is a group of cybercriminals whose main goal is financial gain. A nation-state threat actor acts on behalf of a nation to inflict harm on a rival nation.
An employee has just received a very negative performance review from his manager. The employee feels the review was biased and the poor rating unjustified. In retaliation, the employee accesses confidential employee compensation information from an HR database server and posts it anonymously on Glassdoor.
What kind of attacker is this?
A.Script kiddie
B.Hacktivist
C.Organized crime
D.Malicious insider
D.Malicious insider
Explanation:
A malicious insider attack occurs when someone within the organization uses the credentials they have been legitimately given to carry out an attack. A script kiddie is an individual who carries out an attack using code written by more advanced hackers. A hacktivist’s attacks are usually politically motivated, instead of financially motivated. An organized crime threat actor is a group of cybercriminals whose main goal is financial gain.
Which of the following attackers are most likely to be able to carry out an advanced persistent threat (APT)? (Choose two.)
A.Malicious insider B.Script kiddie C.Hacktivist D.Organized crime E.Nation-state
D.Organized crime
E.Nation-state
Explanation:
An advanced persistent threat (APT) is a prolonged targeted attack in which the attacker gains access to a network and remains there undetected for an extended period of time. As such, only an organized crime or nation-state actor is likely to have the level of sophistication and the funds required to carry out such an attack. Script kiddies, hacktivists, and malicious insiders usually lack the technical expertise and/or the funds necessary to carry out an APT.
Which of the following entities are most likely to become the target of an advanced persistent threat (APT)? (Choose two.)
A.A government contractor B.A website offering lessons on search engine optimization (SEO) C.A multinational bank D.A dental practice E.A community college
A.A government contractor
C.A multinational bank
Explanation:
Advanced persistent threats (APTs) are typically aimed at high-value targets, such as governments, defense contractors, multinational organizations, and financial organizations. Online learning websites, dental practices, and even community colleges are typically not valuable enough as targets to warrant an APT.
Which threat actor is most likely to be motivated by a political cause?
A.Malicious insider
B.Hacktivist
C.Organized crime
D.Script kiddie
B.Hacktivist
Explanation:
A hacktivist’s attacks are usually politically motivated, instead of financially motivated. A malicious insider is usually motivated by either revenge or financial gain. An organized crime actor is most likely motivated by financial gain. A script kiddie may have a variety of motivations, such as notoriety.
Which threat actor is most likely to be motivated by a desire to gain attention?
A.Malicious insider
B.Script kiddie
C.Organized crime
D.Nation-state
B.Script kiddie
Explanation:
A script kiddie may have a variety of motivations. One of the most common is attention. They frequently brag about their exploits in online forums and social media. A malicious insider is usually motivated by either revenge or financial gain. An organized crime actor is most likely motivated by financial gain. A nation-state is most likely motivated by political or military goals.
Which type of penetration test usually provides the most thorough assessment in the least amount of time?
A.Gray box assessment
B.Black box assessment
C.Goals-based assessment
D.White box assessment
D.White box assessment
Explanation:
Because a white box assessment provides the penetration testers with extensive information about the target, it usually provides the most thorough assessment and typically requires the least amount of time to conduct. A gray box test is a blend of black box and white box testing. As such, it takes longer to conduct because more information must be discovered by the
You are performing research that will be used to define the scope of a penetration test that your company will perform for a client. What information must be included in your research? (Choose two.)
A.Why is the test being performed?
B.When was the last time a test was performed? C.What were the results of the last test performed? D.To whom should invoices be sent?
E.Who is the target audience for the test?
A.Why is the test being performed?
E.Who is the target audience for the test?
Explanation:
The scope document must specify, among other things, why the test is being performed and who the target audience is. The other options listed in this question may be included if necessary, but they are not required.
You are documenting the rules of engagement (ROE) for an upcoming penetration test.
Which elements must be included? (Choose two.)
A. A timeline for the engagement
B. A review of laws that specifically govern the target
C.A list of similar organizations that you have assessed in the past
D.A list of the target’s competitors
E.A detailed map of the target’s network
B. A review of laws that specifically govern the target
C.A list of similar organizations that you have assessed in the past
Explanation:
The rules of engagement (ROE) should always include the timeline for the engagement as well as a review of any laws that specifically govern the target to ensure you don’t break them. A list of other organizations that you have tested in the past or a list of the target organization’s competitors is unlikely to be specified in the rules of engagement. A detailed map of the target’s network will probably not be included in a black or gray box test.
You are documenting the rules of engagement (ROE) for an upcoming penetration test.
Which elements should you make sure to include? (Choose two.)
A.Detailed billing procedures
B.A list of out-of-scope systems
C.A list of in-scope systems
D.An approved process for notifying the target’s competitors about the engagement
E.Arbitration procedures for resolving disputes between you and the client
B.A list of out-of-scope systems
C.A list of in-scope systems
Explanation:
The ROE should identify which locations, systems, applications, or other potential targets are included in or excluded from the test. This should identify any third-party service providers that may be impacted by the test such as ISPs, cloud service providers, or security monitoring services. Billing and arbitration procedures will likely be addressed in the general contract between you and the client, not in the ROE. It is unlikely that the client will want you to notify their competitors that you are testing their security.
You are documenting the rules of engagement (ROE) for an upcoming penetration test.
Which elements should be considered? (Choose two.)
A. A list of IP addresses assigned to the systems you will use to conduct the test
B.How you will communicate the results of the test with the target
C.A list of penetration testing tools you will use during the test
D.A list of references from past clients for whom you have conducted penetration tests
E.A list of behaviors that are not allowed on the part of the target during the test
B.How you will communicate the results of the test with the target
E.A list of behaviors that are not allowed on the part of the target during the test
Explanation:
The ROE should specify when and how communications will occur between you and the client. Should you provide daily or weekly updates, or will you simply report when the test is complete? The ROE should also specify the behaviors allowed on the part of the target. For example, engaging in defensive behaviors such as shunning or blacklisting could limit the value of the test.
You are defining the rules of engagement (ROE) for an upcoming penetration test. During this process, you have defined off-limit times when you should not attack the target, a list of in-scope and out-of-scope systems, and data-handling requirements for the information you gather during the test. You also phoned one of the help-desk technicians at the target site and received verbal permission to conduct the test. You recorded the technician’s name and the date in the ROE document.
What did you do incorrectly in this scenario?
A.For privacy reasons, you should not have identified the internal technician by name in the ROE document.
B.Including “off-limits” times reduces the accuracy of the test.
C.The ROE should include written permission from senior management.
D.All systems should be potential targets during the test.
E.The target should not know how you are storing the information gathered during the test.
C.The ROE should include written permission from senior management.
Explanation:
Verbal permission is usually considered insufficient. Before beginning a penetration test, you must obtain a signed agreement from senior management giving you permission to conduct the test. This agreement will function as a “get out of jail free” card should your activities be reported to authorities.
You are defining the rules of engagement (ROE) for an upcoming penetration test. This will be a white box assessment. You have specified that the target may not employ shunning or blacklisting during the test. You have specified that the target must provide you with internal access to the network, a network map, and authentication credentials. You have also specified that applications provided by a SaaS service provider are off-limits during the test. What did you do incorrectly in this scenario?
A.The target should be allowed to use whatever means it chooses to defend itself.
B.Having detailed information about the internal network invalidates the results of the test.
C.All network resources should be subject to testing, including cloud-based resources.
D.Nothing. The ROE has been defined appropriately.
D.Nothing. The ROE has been defined appropriately.
Explanation:
The rules of engagement have been defined appropriately in this scenario. For example, it is quite appropriate to define what defensive behaviors the target is allowed to use during the test. Likewise, a white box test will likely include detailed information about the internal network. It’s also not uncommon for third-party service providers to be excluded from the test.
You are defining the rules of engagement (ROE) for an upcoming penetration test. This will be a black box assessment. The client has specified that they do not want the test to be conducted during peak times of the day, so you added “timeout” time frames to the document when testing will be suspended. You have specified that no communications will occur between you and the client until the end of the test when you submit your final test results. You have also specified that the target must provide you with internal access to the network, a network map, and authentication credentials. What did you do incorrectly in this scenario?
A.Having detailed information about the internal network invalidates the results of the test.
B.Pausing the assessment during peak times invalidates the results of the test.
C.Communications between the testers and the client should occur at regular intervals throughout the test. D.Nothing. The ROE has been defined appropriately.
A.Having detailed information about the internal network invalidates the results of the test.
Explanation:
Because this is a black box assessment, the testers should have no prior knowledge of the environment to be tested nor should they have special access to it. In essence, they should attack the client from the same perspective as a real attacker would. It is quite appropriate to pause testing during peak times to avoid disrupting their critical business operations. It’s also appropriate to communicate with the client only after the test is complete, especially on a black box assessment.
You own a small penetration testing consulting firm. You are worried that a client may sue you months or years after penetration testing is complete if their network is compromised by an exploit that didn’t exist when the test was conducted.
What should you do?
A.Insist that clients sign a nondisclosure agreement (NDA) prior to the test.
B.Include a disclaimer in the agreement indicating that the results are valid only at the point in time when the test was performed.
C.Include an arbitration clause in the agreement to prevent a lawsuit.
D.Insist that clients sign a statement of work (SOW) prior to the test.
B.Include a disclaimer in the agreement indicating that the results are valid only at the point in time when the test was performed.
Explanation:
The testing agreement should contain a disclaimer indicating that the test is valid only at the point in time that it is conducted and that the scope and methodology requested by the client can impact the comprehensiveness of the test. An NDA specifies
what each party in an agreement is allowed to disclose to third parties. An arbitration clause could still result in a settlement that goes against the pen test consultant. A SOW alone won’t protect you against this kind of lawsuit unless it contains a point-in-time clause, discussed earlier.
You own a small penetration testing consulting firm. You are worried that a client who requests a black box assessment may sue you after penetration testing is complete if their network is compromised by an exploit.
What should you do?
A.Insist that clients sign a purchase order prior to the test.
B.Insist that clients sign a master services agreement (MSA) prior to the test.
C.Include a disclaimer in the agreement indicating that the test methodology can impact the comprehensiveness of the test.
D.Refuse to perform black box tests.
C.Include a disclaimer in the agreement indicating that the test methodology can impact the comprehensiveness of the test.
Explanation:
The testing agreement or scope documentation should contain a disclaimer explaining that the scope and methodology requested by the client can impact the comprehensiveness of the test. For example, a white box test is more likely to discover hidden vulnerabilities than a black box test can. A purchase order is a binding agreement to purchase goods or services. An MSA is an agreement that defines terms that will govern future agreements. Black box tests can provide a unique perspective and should not be forsaken.
You are defining the rules of engagement (ROE) for an upcoming penetration test. You are working on the problem resolution section of the document. Which elements should be included in this section? (Choose two.)
A.Clearly defined problem escalation procedures
B.A timeline for the engagement
C.In-scope systems, applications, and service providers
D.Out-of-scope systems, applications, and service providers
E.Acknowledgment that penetration testing carries inherent risks
A.Clearly defined problem escalation procedures
E.Acknowledgment that penetration testing carries inherent risks
Explanation:
When documenting problem handling and resolution in a rules of engagement document, you should clearly define escalation procedures on both sides of the agreement to help minimize downtime for the target organization. You should also include verbiage that requires the client to acknowledge that penetration testing carries inherent risks. A timeline for the engagement, along with scoping information, is also included in the ROE, just not in the problem resolution section.
You work at a penetration testing consulting firm. An organization that you have not worked with previously calls and asks you to perform a black box assessment of its network. You agree on a price and scope over the phone. After quickly designing the test on paper, you begin execution later that afternoon. Was this test conducted properly?
A.Yes, proper penetration test planning and scoping procedures were followed.
B.No, new clients should be properly vetted before beginning an assessment.
C.No, a master service agreement (MSA) should be signed before testing begins.
D.No, the rules of engagement (ROE) for the test should be documented and signed by both parties.
D.No, the rules of engagement (ROE) for the test should be documented and signed by both parties.
Explanation:
The rules of engagement (ROE) should have been clearly defined and signed by both parties before the penetration test begins. Not having the ROE in place exposes your organization to potential litigation should something go wrong during the testing process. The vetting of a new client occurs during the process of scoping the test and creating the ROE document. An MSA defines terms that will govern future agreements.
You are arranging the terms of a penetration test with a new client. Which of the following is an appropriate way to secure legal permission to conduct the test?
A.Ask a member of senior management via email for permission to perform the test.
B.Ask a member of the IT staff over the phone for permission to perform the test.
C.Ask a member of the IT staff to sign a document granting you permission to perform the test.
D.Ask a member of senior management to sign a document granting you permission to perform the test.
D.Ask a member of senior management to sign a document granting you permission to perform the test.
Explanation:
Before conducting a penetration test, you must get written permission from the senior management of the target organization to perform the test. Getting permission verbally or via email is generally not acceptable. Getting permission from the IT staff is also generally not acceptable.
Which type of penetration test best simulates an outsider attack?
A.Black box
B.Gray box
C.White box
D.Blue box
A.Black box
Explanation:
In a black box penetration test, the tester has no prior knowledge of the target. Therefore, it best simulates what would happen during an attack from the outside. White-box and gray-box penetration tests allow the tester to have some degree of prior knowledge about the target.
You need to conduct a penetration test for a client that best assesses the target organization’s vulnerability to a malicious insider who has the network privileges of an average employee. Which type of test should you perform?
A.Gray box
B.White box
C.Black box
D.Red box
A.Gray box
Explanation:
In a gray box penetration test, the tester has partial knowledge of the target. This can be used to simulate a malicious insider attack conducted by an average employee. In a black box penetration test, the tester has no prior knowledge of the target. In a white box test, the tester has extensive knowledge of the target.
Which type of penetration test requires the most time and money to conduct?
A.White box
B.Gray box
C.Black box
D.Green box
C.Black box
Explanation:
Because the penetration tester has no knowledge of the target, a black box test takes the most time and money to conduct. In contrast, gray box and white box tests are usually must less expensive and take less time to conduct because the tester has some level of prior knowledge about the target.
A penetration tester uses a typical employee email account to send a phishing email exploit to managers and executives within the target organization. The goal is to see how many actually fall for the exploit and click the link in the message. What kind of penetration test is being performed in this scenario?
A.Black box
B.Gray box
C.White box
D.Red box
B.Gray box
Explanation:
Because the tester is using an internal email account (the kind used by a typical employee) to conduct the test, the tester is most likely performing a gray box test. In a black box test, the tester would have to use an external email account. In a white box test, the tester would likely use elevated privileges and access to conduct the test.
You work for a penetration testing firm. A client calls and asks you to perform an exhaustive test that deeply probes their infrastructure for vulnerabilities. What kind of test should you recommend?
A.Gray box
B.White box
C.Black box
D.Blue box
B.White box
Explanation:
Because the tester is given extensive internal access to the target network, a white box test usually provides the most exhaustive assessment. More time can be spent probing for deep vulnerabilities than is possible with a black or gray box test.
You are defining the rules of engagement (ROE) for an upcoming penetration test. This will be a white box assessment. This will be an internal test. No third parties may be involved. Which of the following resources could be considered in-scope for the assessment? (Choose two.)
A.Active Directory users
B.Password policies defined within Group Policy C.Microsoft Office 365 cloud applications
D.Google Docs
E.Microsoft Azure web servers
A.Active Directory users
B.Password policies defined within Group Policy
Explanation:
The scope of this engagement in this scenario is limited to the internal network infrastructure. Microsoft Office 365, Google Docs, and Microsoft Azure are all cloud-based services hosted by third parties and are therefore considered out of scope.
What is the most important step in the penetration testing planning and scoping process?
A.Obtaining written authorization from the client
B.Writing the rules of engagement (ROE)
C.Selecting a testing methodology
D.Defining in-scope and out-of-scope systems, applications, and service providers
A.Obtaining written authorization from the client
Explanation:
The most important step in the penetration testing planning and scoping process is to obtain written permission from the target to perform the test. Without written permission, you are considered a hacker and are subject to federal, state, and local laws regarding computer crime (such as U.S. Code, Title 18, Chapter 47, Sections 1029 and 1030).
Which of the following is a formal document that defines exactly what will be done during a penetration test?
A.Master service agreement (MSA)
B.Nondisclosure agreement (NDA)
C.Statement of work (SOW)
D.Purchase order (PO)
C.Statement of work (SOW)
Explanation:
The statement of work (SOW) is a formal document that defines the scope of the penetration test. It identifies exactly what will happen during the test. An MSA defines terms that will govern future agreements. An NDA specifies what each party in an agreement is allowed to disclose to third parties. A purchase order is a binding agreement to make a purchase from a vendor.
You work for a penetration testing firm. You go to dinner with a potential client. To demonstrate your organization’s technical expertise with penetration testing, you list several of your other clients by name and describe in detail various problems your assessments discovered at each one.
Which of the following was violated when you did this?
A.Statement of work (SOW)
B.Nondisclosure agreement (NDA)
C.Master service agreement (MSA)
D.Purchase order (PO)
B.Nondisclosure agreement (NDA)
Explanation:
A nondisclosure agreement (NDA) is a legal contract that defines what confidential information can be shared and what cannot be shared. In most penetration testing agreements, the NDA specifies that the tester may not reveal the results of the test to anyone other than the client itself. A SOW is a formal document that defines the scope of the penetration test. An MSA defines terms that will govern future agreements. A purchase order is a binding agreement to make a purchase from a vendor.
You work for a penetration testing firm. A potential client called about your services. After reviewing what your organization can do, the client decides to schedule a single black box test. If they are happy with the results, they may consider future tests. Which of the following will you likely ask the client to sign first?
A.Purchase order (PO)
B.Nondisclosure agreement (NDA)
C.Master service agreement (MSA)
D.Statement of work (SOW)
A.Purchase order (PO)
Explanation:
Most likely, you will ask the client to sign a purchase order. A purchase order is a binding agreement to make a purchase from a vendor. With a purchase order in place, your organization can justify spending time and money defining a SOW and an NDA for the engagement. Because the client is essentially “trying” your services, an MSA would not yet be required, although it may be in the future.
Which of the following is a contract where both parties agree to most of the terms that will govern future agreements?
A.Master service agreement (MSA)
B.Nondisclosure agreement (NDA)
C.Statement of work (SOW)
D.Purchase order (PO)
A.Master service agreement (MSA)
Explanation:
A master service agreement (MSA) is a contract where both parties agree to most of the terms that will govern future agreements. By defining these terms in an MSA, future agreements are much easier and faster to make. A purchase order is a binding agreement to make a purchase from a vendor. A SOW is a formal document that defines the scope of a penetration test. An NDA specifies what each party in an agreement is allowed to disclose to third parties.
You have been recently hired by a security firm to conduct penetration tests on clients.
Which agreements will your new employer most likely ask you to sign as a condition of employment? (Choose two.)
A.Master service agreement (MSA) B.Nondisclosure agreement (NDA) C.Statement of work (SOW) D.Purchase order (PO) E.Noncompete agreement
B.Nondisclosure agreement (NDA)
E.Noncompete agreement
Explanation:
As an employee of a security firm, you will likely to be asked by your employer to sign a nondisclosure agreement (NDA) and a noncompete agreement. The NDA specifies what each party in an agreement is allowed to disclose to third parties. Your employer likely doesn’t want you to reveal proprietary information to its competitors. The noncompete agreement requires you to agree to not work for a competitor or directly compete with your employer in a future job.
Your penetration testing consulting firm has been negotiating a contract with the U.S. federal government to run penetration tests against some of its systems. Which agreements will you be asked to sign instead of a statement of work (SOW)? (Choose two.)
A.Statement of objective (SOO)
B.Performance work statement (PWS)
C.Noncompete agreement
D.Purchase order (PO)
A.Statement of objective (SOO)
B.Performance work statement (PWS)
Explanation:
Alternatives to a SOW used by the U.S. federal government include a statement of objectives (SOO) and a performance work statement (PWS). Purchase orders and a noncompete agreements are not typically used as alternatives to a SOW.
You are defining the scope of an upcoming penetration test. Your client’s offices are located in a large office complex with many other tenants. The client has asked you to include the organization’s network in the test. Which parameters should be identified as in-scope? (Choose two.)
A.The IP addresses of public-facing web services owned by neighboring tenants
B.The IP address of perimeter security devices owned by neighboring tenants
C.Wireless SSIDs used by neighboring tenants D.Wireless SSIDs used by the client
E.IP address ranges used on the client’s internal network
D.Wireless SSIDs used by the client
E.IP address ranges used on the client’s internal network
Explanation:
If the client’s network itself is in scope, then you need to define the client’s wireless network SSIDs as in-scope. Defining the client’s IP address ranges as in-scope is also important. You must not target third parties, such as neighboring tenants or cloud service providers, without their written permission.
You have recently concluded a penetration test for a client, and now need to write up your final conclusions. What should you do?
A.Rely on your memory of what happened during the test to create the report.
B.Analyze the testers’ written log files.
C.Ask your fellow testers to email you the top three issues they discovered during the test.
D.Ask your client’s IT staff to email you the top three issues they noticed during the test.
B.Analyze the testers’ written log files.
Explanation:
It is important that all penetration testers keep carefully written logs of the actions they take during an assessment. These logs should identify what the tester did, when they did it, what system(s) they were using, what system(s) they were attacking, and what the results were. You should avoid relying upon tester or client memories alone. They tend to be faulty and incomplete.
A client has hired you to test the physical security of their facility. They have given you free rein to try to penetrate their facility using whatever method you want as long as it doesn’t harm anyone or damage the property. What type of assessment is being conducted in this scenario?
A.Goal-based
B.Pre-merger
C.Compliance-based
D.Supply chain
A.Goal-based
Explanation:
This is an example of a goal-based assessment. The goal is to verify the organization’s physical security using whatever means you desire. A premerger test is usually conducted on an organization prior to it merging with another. A compliance-based test is done to ensure that an organization remains in compliance with governmental regulations or corporate policies. A supply chain test involves testing an organization’s vendors.
One of your clients accepts credit cards from customers and uses its internal network and servers to process payments. The credit card companies each specify that the client must undergo regular penetration testing to ensure that its password policies, data isolation policies, access controls, and key management mechanisms adequately protect consumer credit card data.
What type of assessment is required in this scenario?
A.Goal-based
B.Compliance-based
C.Supply chain
D.Red team
B.Compliance-based
Explanation:
A compliance-based assessment is required in this scenario. This is a risk-based assessment that ensures policies or regulations are being followed appropriately. Most likely, the credit card companies will provide the organization with a checklist that the penetration tester will use to conduct the assessment. A goal-based assessment will specify a goal to be met by the test. A supply chain assessment involves testing an organization’s vendors. A red team assessment is usually conducted by internal testers to ensure an organization’s IT staff (the blue team) can adequately defend the network.
One of your clients was recently purchased by a large multinational organization. Before the purchase can be finalized, your client must be subjected to an extensive penetration test.
What kind of assessment is required in this scenario?
A.Objective-based
B.Pre-merger
C.Compliance-based
D.Supply chain
B.Pre-merger
Explanation:
Before two organizations merge, it is common for penetration tests to be conducted to identify any security vulnerabilities that need to be addressed before their networks are connected. An objective-based assessment is designed to test whether information can remain secure. A compliance-based test is done to ensure that an organization remains in compliance with governmental regulations or corporate policies. A supply chain test involves testing an organization’s vendors.
An organization’s network was recently hacked. The attackers first compromised the weak security used by one of the organization’s contractors. Then they used the contractor’s authentication credentials to gain access to the organization itself. Which type of penetration assessment could have prevented this?
A.Objective-based
B.Pre-merger
C.Goal-based
D.Supply chain
D.Supply chain
Explanation:
In a supply chain assessment, a penetration test is conducted on an organization’s vendors to ensure their networks are secure and can’t be used as a pivot point to compromise the organization itself. A goal-based assessment is designed to test a specific aspect of an organization’s security. A premerger test
is usually conducted on an organization prior to it merging with another.
You work on the security team for a large organization. Your team has been tasked with conducting an internal penetration test to verify whether your organization’s IT staff can adequately defend against it. What type of assessment is being used in this scenario?
A.Goal-based
B.Compliance-based
C.Supply chain
D.Red team
D.Red team
Explanation:
A red team assessment is usually conducted by internal testers to ensure an organization’s IT staff (the blue team) can adequately defend the network. A goal-based assessment is designed to test a specific aspect of an organization’s security. A supply chain test involves testing an organization’s vendors. A compliance-based test is performed to ensure that an organization remains in compliance with governmental regulations or corporate policies.
Which of the following tiers of adversaries ranks threat actors, generally speaking, from least threatening to most threatening?
A.Script kiddie, hacktivist, malicious insider, organized crime, nation-state
B.Script kiddie, malicious insider, hacktivist, organized crime, nation-state
C.Hacktivist, script kiddie, malicious insider, nation-state, organized crime
D.Nation-state, organized crime, malicious insider, hacktivist, script kiddie
A.Script kiddie, hacktivist, malicious insider, organized crime, nation-state
Explanation:
Generally speaking, if you were to rank threat actors into tiers from least threatening to most threatening, it would look something like the following: script kiddie > hacktivist > malicious insider > organized crime > nation-state.
One of your clients is a public advocacy group. Some of its political stances are very unpopular with several fringe activists, and they are concerned that a hacktivist may try to hijack their public-facing website. They have asked you to run a penetration test using the same tools and techniques that a typical hacktivist would have the technical aptitude and funds to use. What process has occurred in this scenario?
A.Due diligence
B.Risk acceptance
C.Threat modeling
D.Scope creep
C.Threat modeling
Explanation:
This is an example of threat modeling. Using threat modeling, you determine the type of threat you want to emulate during the penetration test. Then you use the same tools, techniques, and approaches that type of threat would typically use.
You are meeting with a new client to scope out the parameters of a future penetration test. During the course of the discussion, you ask the client if they are willing to accept the fact that a penetration test could cause service disruptions within their organization. The client responds affirmatively. What process has occurred in this scenario?
A.Risk acceptance
B.Due diligence
C.Threat modeling
D.Risk transfer
A.Risk acceptance
Explanation:
This is an example of risk acceptance. You have evaluated the client’s tolerance of the impacts a penetration test could bring to the organization. It is important that the client be ready and able to accept the fact that a penetration test could cause a network outage or a service disruption.
You are running a penetration test for a client. The original test calls for you to test the security of one of the client’s remote branch offices. The client called today and indicated that they are concerned about the security readiness of a second branch office. They insisted that you expand the penetration test to include this second site.
What process occurred in this scenario?
A.Due diligence
B.Risk acceptance
C.Threat modeling
D.Scope creep
D.Scope creep
Explanation:
This is an example of scope creep. Scope creep is the addition of additional parameters and/or targets to the scope of the assessment. This is a common occurrence and should be planned for in your initial scoping. For example, you and the client could agree on pricing and schedule adjustments that could be made if the scope of the test needs to expand.
A client has asked you to run a white box penetration test. Her organization has offices in the United Kingdom, Saudi Arabia, Pakistan, and Hong Kong. You load your penetration testing toolkit onto your laptop and travel to each office to run the assessment on-site. What did you do incorrectly in this scenario?
A.It may be illegal to transport some penetration testing software and hardware internationally.
B.A laptop doesn’t have sufficient computing power to effectively run a penetration test.
C.Travel costs can be reduced by running the assessment remotely from the tester’s home location.
D.Nothing. You did everything correctly.
A.It may be illegal to transport some penetration testing software and hardware internationally.
Explanation:
Many penetration testing tools may be covered by export restrictions. The United States prohibits the export of some types of software and hardware, including encryption tools. If you are traveling abroad with your penetration testing toolkit, you could be arrested if you have prohibited software or hardware in your possession.
A client has asked you to run a white box penetration test. Her organization has offices in the United States, Indonesia, Thailand, and Singapore. To avoid international transportation of your penetration testing software, you upload it to your Google Drive account. Then you travel to each site, download the software, and run it locally on your laptop. Did you handle your penetration testing software appropriately in this scenario?
A.Yes, using Google Drive to access the software internationally shields you from prosecution.
B.No, most foreign nations block access to Google Drive.
C.No, it is legal to transport most penetration testing software into these countries.
D.No, it is illegal to transport most penetration testing software internationally using the Internet.
D.No, it is illegal to transport most penetration testing software internationally using the Internet.
Explanation:
The laws and regulations that apply to penetration testing and penetration testers vary from state to state within the United States. That means you need to understand what laws apply to the work you’re doing. In this scenario, you need to check all federal, state, and local laws that apply to the assessment you plan to carry out. It is recommended that you retain the services of an attorney to keep yourself out of trouble.
You are asked to perform a penetration test for an organization with offices located in New York City, Los Angeles, and Fargo. Which cybersecurity laws and regulations do you need to check as you scope the assessment?
A.U.S. federal cybersecurity law
B.State cybersecurity laws in New York, California, and North Dakota
C.Local cybersecurity laws in each physical location D.Interpol regulations
D.Interpol regulations
Explanation:
The laws and regulations that apply to penetration testing and penetration testers vary from state to state within the United States. That means you need to understand what laws apply to the work you’re doing. In this scenario, you need to check all federal, state, and local laws that apply to the assessment you plan to carry out. It is recommended that you retain the services of an attorney to keep yourself out of trouble.
A client has asked you to run a white box penetration test. The goal is to assess the security of their web-based applications. These applications leverage the Simple Object Access Protocol (SOAP). During the scoping process, you determine that it would be helpful if you had access to the organization’s internal documentation for these applications. Which of the following should you ask your client for?
A.Web Services Description Language (WSDL) documentation
B.Software Development Kit (SDK) documentation C.Web Application Description Language (WADL) documentation
D.Application Programming Interface (API) documentation
A.Web Services Description Language (WSDL) documentation
Explanation:
Web Services Description Language (WSDL) is an XML-based interface definition language used for describing the functionality offered by a SOAP service.
A client has asked you to run a white box penetration test. The goal is to assess the security of their web-based applications. These applications are based on Representational State Transfer (REST) architecture. During the scoping process, you determine that it would be helpful if you had access to the organization’s internal documentation for these applications. Which of the following should you ask your client for?
A.Web Services Description Language (WSDL) documentation
B.Software Development Kit (SDK) documentation C.Web Application Description Language (WADL) documentation
D.Application Programming Interface (API) documentation
C.Web Application Description Language (WADL) documentation
Explanation:
The Web Application Description Language (WADL) is an XML-based machine-readable description of HTTP-based web services. As such, it is typically used with REST services instead of SOAP.
A client has asked you to run a white box penetration test. The goal is to assess the security of several PC applications that were written in-house using the C++ programming language. These applications are used on a day-to-day basis by employees to manage orders, inventory, and payouts. During the scoping process, you determine that it would be helpful if you had access to the organization’s internal software development documentation for these applications. Which of the following should you ask your client for? (Choose two.)
A.Simple Object Access Protocol (SOAP) documentation
B.Software Development Kit (SDK) documentation C.Web Application Description Language (WADL) documentation
D.Application Programming Interface (API) documentation
B.Software Development Kit (SDK) documentation
D.Application Programming Interface (API) documentation
Explanation:
Application programming interface (API) documentation describes how software components communicate. Software development kits (SDKs) also come with documentation. Organizations may create their own SDKs, use commercial SDKs, or use open source SDKs. Understanding which SDKs are in use and where they are can help a penetration tester test applications, especially those written in-house.
You are scoping a black box penetration test for a client. The goal is to see whether you can gain access to the information stored on an internal database server. Which information should the client provide you with prior to starting the test?
A.Architectural diagrams
B.Swagger document
C.XSD
D.Network diagrams
D.Network diagrams
Explanation:
A black box penetration test should simulate the view an external attacker would have of the network. Therefore, the tester should have little or no knowledge of the internal network.
You are scoping a white box penetration test for a client. The goal is to see whether you can gain access to confidential research data stored on an internal database server. You want to target an internally developed data collection application that the client’s end users use on a daily basis to catalog and store information in the database. Which information should the client provide you with prior to starting the test?
A.Architectural diagrams
B.Sample requests
C.XSD
D.All of the above
D.All of the above
Explanation:
In a white box test, you should have access to extensive internal documentation. Because an in-house developed application will be used as the attack vector, you should require the client to provide as much documentation about that application as possible. For example, you should ask for architectural diagrams, sample application requests, and the swagger document, as applicable.
You are scoping a white box penetration test for a client. The goal is to see whether you can gain access to confidential customer data stored on an internal database server. You have asked the client for architectural diagrams. Which information should the client provide you with? (Choose two.)
A.Swagger document B.Simple Object Access Protocol (SOAP) documentation C.Network diagrams D.XSD E.Facility maps
C.Network diagrams
E.Facility maps
Explanation:
When requesting internal architectural diagrams as a part of a white box test, you should typically be supplied with documentation such as network diagrams and facility maps. You can use this information to map out the network topology and locate key infrastructure devices, such as switches, routers, and servers.
You are scoping a white box penetration test for a client. The goal is to see whether you can gain access to confidential research data stored on an internal database server. To facilitate this, you have requested that the client provide you with access to applications that end users use to generate sample application requests. Which specific applications should be included in the request? (Choose two.)
A.An in-house developed desktop application used to access the information stored in the database
B.Microsoft Word, which end users use on a daily basis to compose documents stored in the database C.Microsoft Excel, which end users use on a daily basis to compose spreadsheets stored in the database
D.An in-house developed web application used to generate reports using the information stored in the database
E.Adobe Photoshop, which end users use on a daily basis to edit graphic files stored in the database
A.An in-house developed desktop application used to access the information stored in the database
D.An in-house developed web application used to generate reports using the information stored in the database
Explanation:
Sample application requests are typically used to test applications (desktop or web) that have been developed in-house. Applications developed in-house aren’t usually subjected to the same level of scrutiny as commercial applications, which make them possible attack vectors that can be exploited. Sample application requests aren’t generally required for commercial applications, such as Word, Excel, or Photoshop, because their weaknesses are already well-documented.
You want to generate sample application requests for an in-house developed web application that a client’s users use every day to complete their day-to-day tasks. How should this be done?
A.Enter exactly the same data into the web application that end users enter.
B.Enter data that is similar to the data that end users enter into the application.
C.Enter completely unexpected data into the application.
D.Ask the system administrator to generate the samples for you.
C.Enter completely unexpected data into the application.
Explanation:
Applications developed in-house aren’t usually subjected to the same level of scrutiny as commercial applications, which make them possible attack vectors that can be exploited. For example, when generating sample application requests, most penetration testers throw unexpected information at applications developed in-house to see how the application responds. For example, you may find that entering a very long text string into a field that is expecting only eight characters could generate a buffer overflow error. You could then use this
poor error handling behavior to insert and run malicious code on the web server hosting the application.
