CISSP Security Assessment and Testing Practice Question
During a penetration test, the tester successfully gains access to a server and then attempts to move laterally to other systems. This phase is known as:
⚠ Common exam trap
Test-takers frequently confuse 'exploitation' (the initial breach) with the broader post-exploitation phase, forgetting that lateral movement is a distinct activity that occurs after the initial foothold is established.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-exploitation and lateral movement
After initial access is gained, the phase where the tester moves from the compromised host to other systems within the network is specifically called post-exploitation and lateral movement. This involves using the foothold to pivot, escalate privileges, and access additional resources, which is distinct from the initial exploitation step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scanning and enumeration
Why it's wrong here
Scanning and enumeration is a pre-exploitation phase where the tester actively probes the target network to identify live hosts, open ports, running services, and potential vulnerabilities. This stage involves using tools to map the network topology and gather specific technical details about potential entry points, occurring well before any successful compromise or subsequent internal movement within the network.
- ✗
Exploitation
Why it's wrong here
Exploitation refers specifically to the act of leveraging a discovered vulnerability to gain initial unauthorized access or a foothold on a target system. While critical, this phase concludes once initial access is established and does not encompass the subsequent actions of moving from that newly compromised system to other systems or escalating privileges within the network.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the initial information-gathering phase of a penetration test, often involving passive techniques to collect intelligence about the target organization, its infrastructure, and employees. This stage aims to understand the target's attack surface and potential vectors without directly interacting with the systems, occurring long before any attempt to gain access or move laterally.
- ✓
Post-exploitation and lateral movement
Why this is correct
Post-exploitation begins immediately after initial access to a system is achieved, focusing on maintaining persistence, escalating privileges, and gathering further intelligence from the compromised host. Lateral movement is a critical component of this phase, where the tester utilizes the initial foothold to pivot and gain access to other systems and network segments, expanding their control and understanding of the target environment's internal defenses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.