Pentest+ for Dummies Chapter 1 Prep Test

Question 1

Bob is using nmap to discover ports that are open on the system.
What form of information gathering is Bob performing?
A.Vulnerability identification
B.Active Information Gathering
C.Vulnerability Scanning
D.Passive information Gathering

Answer 1

B.Active Information Gathering

Explanation:
Bob is performing active reconnaissance, or active information gathering, when using a port scanner to discover ports that are open on a system

Question 2

What type of penetration test involves the tester being given no information about the target environment?
A.Black Box
B.White Box
C.Gray Box
D.Red Box

Answer 2

A.Black Box

Explanation:
A black box test is when the pentester is given no knowledge of the environment being tester

Question 3

What type of reconnaissance involves the tester querying the DNS to discover the DNS names and IP addresses used by the customer?
A.Vulnerability Identification
B.Active Information Gathering
C.Vulnerability Scanning
D.Passive Information Gathering

Answer 3

D.Passive Information Gathering

Explanation:
Passive reconnaissance, or passive information gathering is when the pentester uses public Internet resources to discover information about his or her target

Question 4

Which of the following represents a reason to perform a penetration test annually?
A.Cost
B.Time
C.Compliance
D.Know-how

Answer 4

C.Compliance

Explanation:
Organizations may be governed by regulations that force a company to perform penetration tests on a regular basis in order to be compliant

Question 5

Lisa performed a penetration test in your organization and is creating the report.
What should Lisa be sure to communicate within the report?
A.How good she is at hacking
B.Remediation Steps
C.Signed Authorization
D.Resources Used

Answer 5

B.Remediation Steps

Explanation:
The purpose of the penetration test is to better the security of the organization.

Therefore, it is critical the report contains remediation steps on how to improve the security of vulnerable systems

Question 6

Which of the following is critical to perform during the planning and scoping phase of the penetration test?
A.Port Scan
B.Vulnerability Scan
C.Summary of remediation steps
D.Obtain Written Authorization

Answer 6

D.Obtain Written Authorization

Explanation:
It is imperative that you get written authorization to perform the pentest before doing any testing.

Also, be sure to get written authorization from an authorized party such as the business owner or an upper-level manager.

It is not enough to get authorization from a local manager

Question 7

What type of penetration test involves giving the tester only the IP addresses of the servers that you wish to be tested?
A.Black Box
B.White Box
C.Gray Box
D.Red Box

Answer 7

C.Gray Box

Explanation:
A Gray box involves giving limited information to the tester so that the tester is more focused on specific targets during the pentest

Question 8

What is the third phase of the CompTIA penetration testing process?
A.Attacks and Exploits
B.Reporting and Communication
C.Planning and Scoping
D.Information gathering and vulnerability identification

Answer 8

A.Attacks and Exploits

Explanation:
The third phase of the CompTIA pentest process is attacks and exploits

Question 9

What threat actor has limited knowledge of the attacks being performed and just typically runs prebuilt tools to perform the attack?
A.APT
B.Script Kiddie
C.Hacktivist
D.Insider Threat

Answer 9

B.Script Kiddie

Explanation:
A script kiddie has limited technical knowledge of the details of the attack and simply runs the tools that are already created

Question 10

You are part of the team within your organization that performs the attacks during the penetration test.
What is the name for your team?
A.Blue team
B.Black team
C.White team
D.Red team

Answer 10

D.Red team

Explanation:
The red team is the name of the pentest team that simulates the attacks, while the blue team tries to detect and defend against those attacks