CISA Protection of Information Assets Practice Question

Which of the following is the PRIMARY objective of a penetration test?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To identify vulnerabilities that could be exploited by an attacker

Penetration testing aims to identify exploitable vulnerabilities that could be used by an attacker.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To test the incident response capability
Why it's wrong here
Incident response testing is separate from penetration testing.
✗
To validate the effectiveness of security controls
Why it's wrong here
This is a broader objective; penetration testing specifically seeks to exploit weaknesses.
✗
To ensure compliance with security standards
Why it's wrong here
Compliance is a secondary benefit.
✓
To identify vulnerabilities that could be exploited by an attacker
Why this is correct
The primary goal is to discover exploitable vulnerabilities.

Go deeper