CISSP Security Assessment and Testing Practice Question
During a penetration test, the tester gains initial access to a server and then attempts to pivot to other systems. Which phase of the penetration testing process does this represent?
⚠ Common exam trap
CISSP often tests the phases of penetration testing, and candidates may confuse exploitation with post-exploitation; the key is that lateral movement occurs after initial access, so it is post-exploitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-exploitation/lateral movement
After gaining initial access, the penetration tester attempts to pivot to other systems, which is part of post-exploitation and specifically lateral movement. This phase involves expanding access, escalating privileges, and moving laterally within the network to compromise additional targets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Post-exploitation/lateral movement
Why this is correct
After gaining initial access, the penetration tester enters the post-exploitation phase. This involves actions like privilege escalation on the compromised system, establishing persistence to maintain access, and then pivoting to other systems within the network. Lateral movement aims to expand the tester's control and reach additional valuable assets beyond the initial foothold, demonstrating the potential impact of a breach.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the foundational phase of a penetration test, focused on gathering comprehensive information about the target environment and its potential vulnerabilities. This critical intelligence collection, which can be passive or active, occurs *before* any attempts to exploit systems or gain access. Since the question states initial access has already been gained, the reconnaissance phase would have been completed much earlier in the engagement.
- ✗
Exploitation
Why it's wrong here
Exploitation is the specific technical phase where identified vulnerabilities are actively leveraged to compromise a target system and establish an initial point of entry or 'foothold' within the network. This stage involves executing an exploit to gain unauthorized access, often leading to a shell or remote command execution. The question explicitly states that initial access has already been gained, indicating that the exploitation phase has successfully concluded.
- ✗
Reporting
Why it's wrong here
Reporting is the concluding phase of a penetration test, dedicated to comprehensively documenting all discovered vulnerabilities, successful exploitation paths, and the overall security posture of the target environment. This phase involves preparing detailed technical reports and executive summaries, along with actionable recommendations for remediation. It occurs long after any active technical testing, including gaining initial access and subsequent post-exploitation activities, has been completed.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.