Cyber Fund Ch 13 Pen Testing review

Why would a company want a penetration test performed?

Which of these is a popular method of testing situations and learning new tasks in the cyber field?

A(n) ____ forbids the revealing of any information discovered during pen testing.

Which type of attack is best described by a hacker intercepting a login request and obtaining the hash of the password?

Which would you likely see in an executive summary from a pen testing report?

Microsoft’s model of viewing potential attacks based on categories of threat is called ____.

NIST is part of what governmental agency?

Which is not true about Open Source Intelligence?

Which of these is not a function of the NIST cybersecurity framework (CSF)?

____ is an open-source tool for conducting port scanning and is quite popular.

____ is the newest certification from CompTIA to help a company test their network defenses.

Which of the following is true regarding extracting evidence that could be used for criminal prosecution?

Which is true about active information gathering?

Which of the following is not a best practice for a pen tester?

Which of the following describes a technique to discover what services are running on a remote system?

The ____ defines exactly what will be tested.

A business hires a reputable pen-testing firm to test their cloud based system. Which of these must be done first?

Which of the following is NOT one of the five Ws of penetration testing?

A data-flow diagram is a feature of ____.

____ is identifying the potential threats to a business to find the high-value target.

In a ____ test, the pen tester has no knowledge of the system to be tested.

Which is the best reason for achieving a certification for pen testing that the customer would care about?

Which best describes scope creep?

Which is an example of a semi-passive attempt at gaining information?

Which of the following describes a common penetration test using social engineering?

Which organization has created a code of ethics for their candidates with 19 standards?

____ is an open-source security project that could be used maliciously and is extensively covered in the GPEN cert,

The highest level of certification from EC-Council, the LPT, is unique because ____.

Adding a cushion to the timeline of penetration testing is commonly referred to as ____.

Which of the following best describes a pen tester listing vulnerabilities found during a penetration test?