Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of reconnaissance in a penetration test?
Given a scenario, determine the appropriate phase of a penetration test
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
An intentionally vulnerable application for practicing web security in a controlled lab. Useful supplementary work for application-security topics.
Try it: Run a local, isolated instance using the project's instructions. Complete one introductory challenge, explain its root cause, and write the server-side control that would prevent it.
Open-source application; can run locally. Keep the intentionally vulnerable app isolated from public networks.
OWASP's testing methodology adds structure to application-security review. It supplements exam objectives rather than replacing a certification owner's guide.
Try it: Choose one testing category relevant to a missed question. In your own lab, record the test precondition, expected secure behavior, evidence, and remediation.
Free to read. Perform exercises only in your own lab or an explicitly authorized environment.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of reconnaissance in a penetration test?
Gathering preliminary information about the target
Exploiting identified vulnerabilities
Installing persistence mechanisms
Covering tracks after the engagement
Correct answer
Gathering preliminary information about the target
Reconnaissance involves collecting publicly available and non-public information to understand the target environment. This phase helps in identifying potential attack vectors before active testing begins.
Which of the following best describes a phishing attack?
Tricking users into revealing sensitive information
Sending high-volume traffic to disrupt services
Exploiting software buffer overflows
Intercepting unencrypted wireless traffic
Correct answer
Tricking users into revealing sensitive information
Phishing relies on social engineering to deceive individuals into providing confidential data, often through fraudulent emails or websites. It does not rely on technical system vulnerabilities.
Why is it important to define the scope of a penetration test?
To limit the testing area and reduce legal risk
To ensure all systems are compromised
To increase the duration of the engagement
To avoid using automated tools
Correct answer
To limit the testing area and reduce legal risk
A clearly defined scope protects both the tester and the organization by outlining what is authorized. It helps prevent unintended impacts and legal issues during the assessment.
What does the principle of least privilege aim to achieve?
Minimize the attack surface for user accounts
Maximize system performance
Ensure all users have administrative access
Simplify password management
Correct answer
Minimize the attack surface for user accounts
Least privilege restricts user and application access to the minimum necessary to perform their tasks. This reduces the potential impact of a compromised account.
Which tool is commonly used for network mapping during a penetration test?
Nmap
Wireshark
Burp Suite
John the Ripper
Correct answer
Nmap
Nmap is widely used to discover hosts and services on a network, providing a map of the target environment. Other tools serve different functions such as packet analysis or vulnerability scanning.
What is a common goal of post-exploitation activities?
Maintaining access for future operations
Announcing the compromise publicly
Restoring all modified systems
Disabling all logging mechanisms immediately
Correct answer
Maintaining access for future operations
Post-exploitation focuses on maintaining control, gathering additional evidence, and understanding the depth of access. This phase helps in assessing the true impact of the compromise.
Which practice helps in identifying insecure storage of credentials in an application?
Checking for hardcoded secrets in source code
Monitoring network latency
Increasing session timeout values
Enabling multi-factor authentication
Correct answer
Checking for hardcoded secrets in source code
Hardcoded or poorly stored credentials can be discovered through code review and configuration analysis. This is a common finding during security assessments of web applications.
What is the purpose of using a proxy tool during web application testing?
To intercept and modify HTTP requests
To increase server processing speed
To encrypt database connections
To generate random user agents
Correct answer
To intercept and modify HTTP requests
Proxy tools allow testers to inspect, modify, and replay web traffic between the client and server. This helps in identifying logic flaws and input validation issues.
Which activity is most likely to be performed during the enumeration phase of a network assessment?
Identifying live hosts and open ports
Installing a rootkit on compromised systems
Destroying logs to avoid detection
Encrypting exfiltrated data
Correct answer
Identifying live hosts and open ports
Enumeration involves gathering detailed information about network resources, such as user accounts, shares, and services. Identifying live hosts and open ports is typically part of discovery and enumeration.
What is a common mitigation for SQL injection vulnerabilities?
Using parameterized queries
Increasing session timeouts
Disabling JavaScript in browsers
Allowing unrestricted file uploads
Correct answer
Using parameterized queries
Parameterized queries ensure that user input is treated as data rather than executable code, effectively preventing SQL injection. Other options do not address the root cause of SQL injection.
Which statement best describes the role of a pivot in a penetration test?
Using a compromised system to access additional network segments
Encrypting all traffic to avoid detection
Reporting findings to stakeholders immediately
Replacing default credentials on all devices
Correct answer
Using a compromised system to access additional network segments
Pivoting allows testers to leverage a compromised host as a gateway to reach otherwise inaccessible systems within the target network. It is a common technique to expand access during internal or post-exploitation phases.
What is a typical outcome of a vulnerability scan?
A list of identified weaknesses with severity ratings
Exploitation of all discovered vulnerabilities
Permanently blocking all network traffic
Automatic patching of affected systems
Correct answer
A list of identified weaknesses with severity ratings
Vulnerability scanners identify potential weaknesses and often assign severity ratings to help prioritize remediation. They do not automatically exploit or patch systems.
Which practice is recommended to reduce the risk of credential theft?
Implementing multi-factor authentication
Using the same password across multiple systems
Storing passwords in plain text configuration files
Sharing accounts among team members
Correct answer
Using the same password across multiple systems
Multi-factor authentication adds an additional verification layer, making it significantly harder for attackers to use stolen credentials. The other options increase risk.
What is the purpose of documenting findings during a penetration test?
To provide clear evidence and remediation guidance
To increase the complexity of the assessment
To avoid communicating with the client
To reduce the time spent in the reporting phase
Correct answer
To provide clear evidence and remediation guidance
Well-documented findings help stakeholders understand the issues, their impact, and how to remediate them. Clear documentation supports effective risk management and follow-up validation.
Which technique is commonly used to evade basic network-based intrusion detection systems?
Fragmenting packets to avoid signature detection
Sending traffic only during business hours
Using strong encryption for all communications
Increasing the TTL value on packets
Correct answer
Fragmenting packets to avoid signature detection
Packet fragmentation can break up malicious payloads across multiple packets, helping evade signature-based detection mechanisms that rely on inspecting complete packets.
Recall the answer before opening each card.
To gather preliminary information about the target without direct interaction, identifying potential attack vectors before active testing begins.
By tricking users into revealing sensitive data through deceptive emails or websites, exploiting social engineering rather than technical vulnerabilities.
To limit the testing area and reduce legal risk by clearly defining authorized targets, preventing unintended impact during the assessment.
Minimizes the attack surface for user accounts by restricting access to only what is necessary, reducing the impact of a compromise.
Nmap is used to discover hosts and services on a network, providing a map of the target environment.
Maintaining access for future operations and gathering additional evidence to assess the depth of compromise.
By checking for hardcoded secrets in source code through code review and configuration analysis.
To intercept and modify HTTP requests to inspect, modify, and replay traffic for identifying logic flaws and input validation issues.
Identifying live hosts and open ports to gather detailed information about network resources like user accounts and services.
Using parameterized queries to treat user input as data, not executable code, preventing injection attacks.
Using a compromised system to access additional network segments, expanding reach to otherwise inaccessible systems.
A list of identified weaknesses with severity ratings to prioritize remediation.
Using multi-factor authentication adds an additional verification layer, making stolen credentials harder to use.
To provide clear evidence and remediation guidance, supporting effective risk management and follow-up validation.
By breaking up malicious payloads across multiple packets, avoiding signature detection that relies on inspecting complete packets.
Reconnaissance collects preliminary info without direct interaction; enumeration is active extraction of detailed data from discovered hosts.
It separates code from data, ensuring user input is treated as data only, so it cannot alter SQL command structure.
It does not automatically exploit or patch systems; it only identifies potential weaknesses and assigns severity.
Phishing specifically uses deceptive electronic communications (email, websites) to trick users into revealing sensitive info.
By granting only necessary permissions, an attacker cannot access sensitive resources beyond the account's scope.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This practice bank emphasizes understanding the sequence and objectives of penetration testing phases. Reconnaissance (Question 1) is about gathering preliminary information. Enumeration (Question 9) involves identifying live hosts and open ports. Post-exploitation (Question 6) aims to maintain access. Scoping (Question 3) limits testing area to reduce legal risk. Each phase has distinct activities and goals; misidentifying a phase can lead to incorrect subsequent decisions.
Social engineering attacks like phishing (Question 2) exploit human psychology to trick users into revealing sensitive information. The principle of least privilege (Question 4) minimizes attack surface by granting only necessary access. Both concepts require testers to recognize deceptive techniques and recommend access controls. Understanding why phishing works (trust manipulation) and how least privilege reduces damage from compromised accounts is critical.
Tools like Nmap (Question 5) are used for network mapping to discover hosts and services. Proxy tools (Question 8) intercept and modify HTTP requests to test web applications. Lateral movement via pivoting (Question 11) uses a compromised system to access other network segments. Evasion techniques such as packet fragmentation (Question 15) help avoid detection by intrusion detection systems. Selecting the correct tool for each task is essential.
Identifying vulnerabilities like hardcoded credentials (Question 7) requires code review and configuration checks. SQL injection (Question 10) is mitigated by parameterized queries, which separate data from code. Vulnerability scans (Question 12) produce lists of weaknesses with severity ratings. Thorough documentation (Question 14) provides evidence and remediation guidance. These practices help in reporting and fixing security flaws.
Study workflow
Before testing, collaborate with stakeholders to outline targets, exclusions, testing windows, and legal boundaries. Document signed authorization to avoid legal issues. This step ensures all parties agree on the assessment's boundaries and reduces risk of unintended damage.
Collect publicly available information using OSINT techniques: search engines, DNS records, social media, job postings. Avoid direct interaction with target systems during this phase. Document all findings for later use in active tests.
Use tools like Nmap to identify live hosts, open ports, and running services. For each service, enumerate versions and configurations. Perform additional enumeration for user accounts, shares, and other details. Record all data to plan exploitation.
Attempt to exploit discovered vulnerabilities in a safe manner. After gaining initial access, use pivoting to move laterally through the network. Maintain access while documenting each step. Avoid destructive actions unless authorized.
Compile all findings into a clear report: executive summary, technical details, risk ratings, and remediation recommendations. Include evidence like screenshots and logs. Present to stakeholders and validate fixes in a follow-up assessment.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
A vulnerability scan is an automated process that identifies potential weaknesses and assigns severity ratings. A penetration test simulates actual attacks to exploit flaws, assess real risk, and test defenses. Scans are broader but less thorough; pen tests are deeper and manual.
Pivoting uses a compromised host as a proxy to access other systems that are not directly reachable. The tester routes traffic through the controlled machine, effectively expanding the attack surface within the target network. It is essential for assessing internal security.
Common evasion techniques include packet fragmentation (splitting payloads), encoding payloads (e.g., base64), using SSL encryption, and varying timing to avoid signature detection. These methods help evade signature-based IDS but may not bypass advanced behavior-based systems.
Least privilege limits accounts to minimal necessary permissions, reducing the blast radius if compromised. During a pen test, understanding this principle helps testers identify excessive privileges and recommend access controls to mitigate potential lateral movement or privilege escalation.
A penetration test report should include an executive summary, scope, methodology, detailed findings with severity ratings, evidence (screenshots, logs), and actionable remediation steps. It must be clear for both technical and non-technical stakeholders to support risk management decisions.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
