CISSP Security Assessment and Testing Practice Question
During a penetration test, the tester gains initial access to a server and then attempts to pivot to other systems. Which phase of the penetration testing process does this represent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-exploitation/lateral movement
Post-exploitation/lateral movement involves leveraging initial access to move within the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Post-exploitation/lateral movement
Why this is correct
After gaining initial access, the penetration tester enters the post-exploitation phase. This involves actions like privilege escalation on the compromised system, establishing persistence to maintain access, and then pivoting to other systems within the network. Lateral movement aims to expand the tester's control and reach additional valuable assets beyond the initial foothold, demonstrating the potential impact of a breach.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the foundational phase of a penetration test, focused on gathering comprehensive information about the target environment and its potential vulnerabilities. This critical intelligence collection, which can be passive or active, occurs *before* any attempts to exploit systems or gain access. Since the question states initial access has already been gained, the reconnaissance phase would have been completed much earlier in the engagement.
- ✗
Exploitation
Why it's wrong here
Exploitation is the specific technical phase where identified vulnerabilities are actively leveraged to compromise a target system and establish an initial point of entry or 'foothold' within the network. This stage involves executing an exploit to gain unauthorized access, often leading to a shell or remote command execution. The question explicitly states that initial access has already been gained, indicating that the exploitation phase has successfully concluded.
- ✗
Reporting
Why it's wrong here
Reporting is the concluding phase of a penetration test, dedicated to comprehensively documenting all discovered vulnerabilities, successful exploitation paths, and the overall security posture of the target environment. This phase involves preparing detailed technical reports and executive summaries, along with actionable recommendations for remediation. It occurs long after any active technical testing, including gaining initial access and subsequent post-exploitation activities, has been completed.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.