Penetration Tests

1. A security manager is explaining why physical penetration testing is critical even when an organization has strong network firewalls and encrypted systems. Which statement best explains the relationship between physical access and cybersecurity?

A. Physical penetration testing is primarily for assessing badge access systems; it has minimal relevance to cybersecurity because network controls are sufficient B. Physical access can completely bypass operating system security — an attacker with physical access can modify the boot process, boot from external media, or alter OS files, circumventing encryption and network controls without any network traffic C. Physical security is the responsibility of facilities management, not cybersecurity; pen testers focus exclusively on network and application layers D. Physical penetration testing is only relevant for government and military facilities; commercial organizations can rely on network controls to compensate for physical security gaps

2. A penetration testing firm is hired to evaluate a company's security. The firm is given no information about the target environment — no network diagrams, no system inventories, no IP address ranges. The testers must discover everything themselves before any attack can begin. What type of test is this?

A. A partially known environment test; the testers have been given some information (the target company name) but must discover the technical details B. A blind test (unknown environment); the testers have no prior knowledge of the target systems and must conduct full reconnaissance to discover the environment before any attack attempt C. A known environment test; the testing firm was hired by the company, so the testing team has inherent knowledge of the target D. A vulnerability assessment; the testers are gathering information about the environment rather than actively attacking

3. A pen tester is gathering information about a target organization. She examines the company's LinkedIn page for employee profiles, reviews conference talks given by the organization's engineers, reads through Reddit threads where employees discussed a recent system migration, and searches public job postings for clues about the technology stack. At no point does she send any network traffic to the target. What type of reconnaissance is this?

A. Active reconnaissance; the pen tester is actively gathering information about the target organization B. Passive reconnaissance; all information is gathered from public open sources without any direct interaction with the target's systems, making this activity very difficult for the target to detect C. Social engineering; the pen tester is using deception to gather information about the target organization D. OSINT-only reconnaissance is not a recognized category; all information gathering that informs an attack is considered active reconnaissance

4. During a penetration test, the testers send crafted TCP packets to 1,000 IP addresses in the target's network range to determine which hosts are live and what ports are open. They then send additional probes to identify the operating system and service versions running on responsive hosts. The results appear in the target's firewall logs. Which type of reconnaissance is being performed?

A. Passive reconnaissance; the testers are gathering technical information about the target without physically interacting with the facility B. Active reconnaissance; the testers are directly interacting with target systems by sending probe packets — this generates network traffic visible in logs, including the ping scan, port scan, OS fingerprinting, and service/version scans C. Exploitation; actively testing ports and services constitutes an attack on the target systems D. Vulnerability scanning; automated tools that scan ports and identify services are classified separately from reconnaissance

5. An organization implements a model where one team continuously attacks its own systems looking for vulnerabilities, and a second team simultaneously monitors for those attacks and patches exploited gaps. After each patch, the attacking team retests the same area. This creates a feedback loop where the organization continuously improves its defenses. Which pentesting approach does this describe?

A. A one-time penetration test; the periodic nature of retesting constitutes separate individual engagements rather than a continuous process B. The integrated (continuous) pentesting approach; red and blue teams work together in an ongoing cycle where the red team finds vulnerabilities, the blue team remediates them, and the red team retests — creating continuous security improvement C. A purple team exercise; this is only called purple team when the red and blue teams formally share information and collaborate at the same time D. A known environment test; the attacking team must have full system knowledge to mount targeted attacks against specific systems

6. A company hires a pen testing firm and provides them with complete network documentation including network diagrams, IP address inventories, a list of all servers and their operating systems, and application architecture diagrams before the test begins. The testers use this information to immediately focus on likely vulnerabilities without spending time discovering the environment. What type of environment is this?

A. An unknown environment; the testers are unfamiliar with the actual configurations until they examine the provided documentation B. A known environment (full disclosure / white box); the organization provides complete information upfront, allowing testers to focus entirely on finding and exploiting vulnerabilities rather than spending time on environmental discovery C. A partially known environment; providing documentation still leaves some systems unknown since documents may be incomplete D. A compliance audit; providing documentation to a third party and having them analyze it constitutes an audit rather than a penetration test

Matching: Pentesting Concepts

Match each concept (1–4) to its correct description (A–D).

1Red Team

2Blue Team

3Passive Reconnaissance

4Active Reconnaissance

AGathering information from public open sources (social media, websites, forums) without sending any traffic to the target; very difficult for the target to detect

BOffensive penetration testing group that simulates attackers by actively searching for and exploiting vulnerabilities

CDirectly interacting with target systems through ping scans, port scans, OS fingerprinting, and service identification; generates traffic visible in logs

DDefensive security group that identifies attacks in real time, responds to incidents, and works to prevent unauthorized access

Penetration Tests — Quiz