GPEN Pen Test Planning Practice Test 2 — 15 Questions

Question 1

During planning for a penetration test, the client states the goal is to evaluate how well the security operations center detects and responds to attacker activity. Which engagement type best aligns with this objective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A red team engagement that emulates adversary tactics and measures detection and response.. When the goal is evaluating detection and response, the engagement should generate realistic adversary activity that the defensive team can observe and act on. A red team engagement does exactly that, with objectives tied to whether the SOC detects, investigates, and contains the simulated intrusion, producing measurable findings about people and process rather than only technical weaknesses.

Answer

A vulnerability assessment that enumerates and rates missing patches across the environment.

Answer

A wireless survey mapping access point coverage and rogue device presence.

Answer

A compliance audit against a regulatory framework with control-by-control evidence collection.

Question 2

You are planning a penetration test for a healthcare provider that must comply with HIPAA. The client wants to test a new patient portal hosted on AWS. During the kickoff meeting, the client's legal team asks how you will handle any protected health information (PHI) that you might encounter. Which of the following is the most appropriate action to take before testing begins?

Accepted Answer

Sign a Business Associate Agreement (BAA) with the client and ensure your testing infrastructure is covered under it.. Under HIPAA, a penetration tester acting as a business associate must sign a BAA before accessing systems that may contain PHI. This agreement establishes permissible uses and safeguards for protected health information. Without it, the engagement could be non-compliant regardless of technical precautions.

Answer

Encrypt all test data at rest and in transit, and avoid accessing any real patient data by using synthetic records.

Answer

Obtain written authorization from the client's CEO and proceed with testing without additional agreements.

Answer

Conduct the test only after hours to minimize the risk of encountering live patient data.

Question 3

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 4

You are the lead penetration tester for a financial services client. During the scoping meeting, the client states they want to test their external perimeter but are concerned about accidental disruption to production trading systems. They ask you to propose a testing approach that minimizes operational risk while still validating exploitable vulnerabilities. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Execute a controlled penetration test using non-destructive exploitation techniques, with a defined stop condition for any sign of instability.. The client requires validation of exploitable vulnerabilities with minimal risk to production. A controlled penetration test using non-destructive techniques and clear stop conditions achieves this by avoiding disruptive payloads and ensuring immediate cessation if instability occurs. It respects the client's risk tolerance while still providing meaningful security validation, unlike approaches that either disrupt services or fail to validate exploitability.

Answer

Simulate an insider threat by deploying a physical implant in the data center to test physical security controls.

Answer

Conduct a vulnerability assessment with authenticated scans during off-peak hours and manually validate only critical findings.

Answer

Perform a full-scale denial-of-service test against the trading platform to assess resilience under attack conditions.

Question 5

A client asks you to perform a penetration test on their internal network. During the planning phase, they provide you with a list of IP addresses and ask you to sign a document that limits your testing to those addresses. Which of the following best describes the purpose of this document?

Accepted Answer

It defines the scope of the engagement and legally authorizes testing only on the specified targets.. The document is a scope and authorization agreement. It legally permits testing only on specified IP addresses and protects both parties by clearly defining what is allowed. Without it, testing could be deemed unauthorized, leading to legal consequences.

Answer

It is a liability waiver that absolves the tester of any responsibility for system damage.

Answer

It is a service level agreement outlining the expected uptime of the target systems during testing.

Answer

It serves as a non-disclosure agreement to protect the client's confidential information.

Question 6

You are the lead penetration tester for an engagement at a regional bank. The client's legal team has approved testing of their external IP range, but the Statement of Work does not mention the third-party core banking platform hosted by a vendor on a shared subnet. During reconnaissance, you discover that one of the client's external IPs routes directly into the vendor's shared environment. What is the MOST appropriate action before conducting any exploitation?

Accepted Answer

Pause testing and obtain written authorization from both the client and the third-party vendor covering the shared environment.. Discovering that an in-scope IP routes into a third-party shared environment creates a legal scope conflict. The tester must halt activity on that asset and secure written authorization from both the client and the hosting vendor before any exploitation. This aligns with Rules of Engagement principles that require explicit consent for every tested system, especially third-party infrastructure.

Answer

Exploit the vulnerability but immediately notify the vendor after obtaining the initial shell to demonstrate impact.

Answer

Document the finding as informational and skip any testing of that IP, moving on to other in-scope targets.

Answer

Continue testing because the IP address appears in the client's external range and was approved in the Statement of Work.

Question 7

You are planning a penetration test for a healthcare provider that must comply with HIPAA. The client wants to ensure that any protected health information (PHI) accessed during testing is handled securely. Which of the following is the MOST critical element to include in the data handling plan?

Accepted Answer

A detailed procedure for encrypting any extracted PHI and securely destroying it after the engagement.. The most critical element is a procedure for encrypting extracted PHI and securely destroying it after the engagement. This directly addresses HIPAA requirements for protecting PHI and minimizes the risk of unauthorized disclosure. Other elements like NDAs, scope, and scheduling are important but do not provide the necessary technical safeguards for PHI encountered during testing.

Answer

A schedule of testing activities to avoid peak business hours.

Answer

A list of all IP addresses and hostnames that are in scope for testing.

Answer

A requirement that all testers sign a non-disclosure agreement (NDA) before testing begins.

Question 8

You are planning a penetration test for a client that has a hybrid cloud environment. The client's security team wants to ensure that the test does not violate the shared responsibility model of their cloud provider. Which of the following should you do FIRST to align the test with the cloud provider's policies?

Accepted Answer

Review the cloud provider's acceptable use policy and penetration testing guidelines.. The first step is to review the cloud provider's penetration testing policies. These policies define what is allowed, what requires notification, and what is strictly prohibited. Aligning with them ensures the test is both effective and compliant, avoiding disruption to the client's cloud services.

Answer

Deploy a jump box in the cloud to conduct testing from within the provider's network.

Answer

Assume that the client's authorization covers all cloud resources since they pay for the service.

Answer

Obtain written authorization from the client's CEO to test all cloud-hosted assets.

Question 9

A healthcare client hires your team for an internal penetration test. During the kickoff meeting, the client's compliance officer asks which document formally defines the specific systems, time windows, and testing techniques that are authorized for the engagement. Which document should you reference?

Accepted Answer

The Rules of Engagement. The Rules of Engagement is the document that operationalizes the engagement by listing authorized targets, permitted techniques, testing windows, escalation contacts, and data handling requirements. It bridges contractual documents like the Statement of Work and the actual execution of testing, giving compliance and legal stakeholders a clear, auditable definition of what is and is not allowed.

Answer

The Statement of Work

Answer

The master services agreement

Answer

The Non-Disclosure Agreement

Question 10

You are drafting the Rules of Engagement (RoE) for a penetration test of a client's internal network. The client wants to ensure that the engagement is legally sound and that all parties understand their responsibilities. Which TWO of the following items are essential to include in the RoE? (Choose two.)

Accepted Answer

Explicit written authorization from the client to perform the test.. The two essential items are explicit written authorization and emergency contact information. Written authorization provides legal protection and confirms consent, while emergency contacts ensure rapid response to incidents. These elements are fundamental to a legally sound and operationally safe penetration test, distinguishing the RoE from other planning documents.

Answer

A statement of work (SOW) detailing the deliverables and timeline.

Answer

A list of all vulnerabilities that will be tested.

Answer

The specific tools and techniques that will be used during the test.

Question 11

During the planning phase of a penetration test for a multinational corporation, you discover that the client's legal department requires all testing activities to comply with the laws of each country where their offices are located. The client has offices in Germany, Brazil, and Japan. Which of the following is the MOST important consideration when planning the engagement?

Accepted Answer

Ensure that testing does not violate any local laws regarding unauthorized access, even if the client has authorized it.. The most important consideration is ensuring that testing activities comply with the local laws of each country where targets reside. Client authorization does not override local criminal laws. A thorough legal review and, if necessary, local legal counsel are essential to avoid criminal liability.

Answer

Perform all testing from a central location in the client's home country to avoid international legal issues.

Answer

Use only automated tools that are approved by the client's legal department in each country.

Answer

Obtain a single global authorization letter from the client's headquarters that covers all offices.

Question 12

You are planning an external penetration test for a financial services firm. The client's legal team wants assurance that the engagement can be defended if law enforcement or regulators inquire about the testing. Which TWO of the following should be included in the Rules of Engagement to provide this assurance? (Choose two.)

Accepted Answer

A list of authorized source IP addresses from which testing will originate.. Authorized source IP addresses and named client signatories are the two elements that most directly support legal defensibility. The source IPs let the client and authorities distinguish sanctioned traffic from real attacks, while the signatories establish a documented chain of authorization. Together they demonstrate that the activity was explicitly approved by authorized parties and originated from known, approved infrastructure.

Answer

The penetration tester's personal home address and after-hours phone number.

Answer

A detailed exploit payload library the testers plan to use against production systems.

Answer

A guarantee that no production system will experience any disruption during testing.

Question 13

A client asks you to perform a penetration test on their web application. During the planning phase, they mention that the application is hosted on a third-party cloud provider and they do not have written permission from the provider to test the underlying infrastructure. What is the MOST appropriate action?

Accepted Answer

Request that the client obtain written authorization from the cloud provider before any testing begins.. The most appropriate action is to request that the client obtain written authorization from the cloud provider. This ensures the testing is legal and compliant with the provider's policies. Proceeding without it or limiting testing does not resolve the fundamental authorization gap and could expose both parties to legal and operational risks.

Answer

Limit testing to a static code review of the application source code to avoid any interaction with the cloud environment.

Answer

Perform the test anyway, since the client owns the application and has authorized you to test it.

Answer

Proceed with testing the application layer only, avoiding any tests that could impact the cloud infrastructure.

Question 14

During a penetration test for a multinational retailer, you discover that a legacy internal application in scope contains a hardcoded credential that also grants access to a payment processing system the client explicitly excluded from testing. You have not yet used the credential. What is the MOST appropriate course of action?

Accepted Answer

Immediately notify the client's designated point of contact, document the finding, and await written guidance before accessing the excluded system.. When testing reveals a path into an explicitly excluded system, the tester must stop and escalate rather than proceed. Notifying the client contact, documenting the discovery, and awaiting written direction respects the Rules of Engagement while ensuring the client can act on a serious risk. This balances the obligation to report critical findings with the legal boundary the client set.

Answer

Report the hardcoded credential as an informational finding without mentioning the link to the excluded payment system.

Answer

Continue testing other in-scope systems and include the credential finding in the final report at the end of the engagement.

Answer

Use the credential only to confirm it works against the excluded system, then report the finding without making changes.

Question 15

You are planning a penetration test for a client with a large wireless network. The client wants to assess the security of their WPA3-Enterprise deployment. Which of the following should be included in the Rules of Engagement to address the risk of disrupting legitimate wireless users?

Accepted Answer

A schedule for testing during off-peak hours and a maximum number of deauthentication frames to send per minute.. The most appropriate inclusion is a schedule for off-peak testing and a limit on deauthentication frames. This minimizes the number of users affected and prevents network instability. It directly mitigates the risk of disrupting legitimate wireless users while still allowing active testing of WPA3-Enterprise security. Other options either do not sufficiently reduce risk or limit testing effectiveness.

Answer

A requirement to use only passive wireless scanning techniques and avoid any active attacks.

Answer

A requirement to perform all wireless testing only during business hours to blend in with normal traffic.

Answer

A predefined list of authorized MAC addresses for testing devices to prevent accidental disconnections.