1Which of the following best describes the primary goal of the Executive Summary in a penetration test report?
A.To provide a step-by-step guide on how to patch software vulnerabilities
B.To explain the high-level business risks and impact to non-technical stakeholders
C.To provide raw scanning logs and exploit code to system administrators
D.To list every specific command used during the engagement
Correct Answer: To explain the high-level business risks and impact to non-technical stakeholders
Explanation:
The Executive Summary is designed for C-level executives and management. It focuses on business risk, financial impact, and high-level findings rather than technical details.
Incorrect! Try again.
2In the context of communication triggers, what constitutes a Critical Finding that requires immediate notification?
A.Discovering a vulnerability that allows immediate remote code execution on a production server
B.Finding a server that does not respond to ICMP ping requests
C.Identifying an outdated version of jQuery with no known exploits
D.Locating a sub-domain that returns a 404 error
Correct Answer: Discovering a vulnerability that allows immediate remote code execution on a production server
Explanation:
A critical finding implies an imminent threat to the organization's assets or operations (like RCE on production) and requires immediate 'out-of-band' communication, bypassing the standard reporting timeline.
Incorrect! Try again.
3Which tool is specifically designed to facilitate collaborative reporting and vulnerability management during a penetration test?
A.Dradis
B.Nmap
C.John the Ripper
D.Wireshark
Correct Answer: Dradis
Explanation:
Dradis is an open-source reporting and collaboration platform that allows penetration testers to consolidate findings from various tools and generate reports.
Incorrect! Try again.
4When defining the Communication Path at the start of an engagement, what is the most important information to establish?
A.The specific Linux kernel versions of the targets
B.The brand of router used by the ISP
C.The preferred font size for the final PDF report
D.A contact list with primary and secondary contacts, including emergency numbers
Correct Answer: A contact list with primary and secondary contacts, including emergency numbers
Explanation:
Establishing a clear communication path with a contact list ensures that if a critical issue arises or the test causes a denial of service, the tester knows exactly who to call immediately.
Incorrect! Try again.
5Which section of a penetration test report is primarily intended for system administrators and developers?
A.Document Control
B.Executive Summary
C.Statement of Scope
D.Technical Findings and Remediation
Correct Answer: Technical Findings and Remediation
Explanation:
The Technical Findings section includes detailed reproduction steps, technical analysis, specific CVEs, and remediation advice required by technical staff to fix the issues.
Incorrect! Try again.
6What is the purpose of the 'Methodology' section in a penetration test report?
A.To provide a biography of the penetration tester
B.To list the hardware specifications of the tester's laptop
C.To list the prices of the tools used
D.To describe the approach, standards (e.g., PTES, OWASP), and phases undertaken during the test
Correct Answer: To describe the approach, standards (e.g., PTES, OWASP), and phases undertaken during the test
Explanation:
The Methodology section outlines the standards and logic followed (such as OSSTMM or PTES) to ensure the client understands how the test was conducted and that it was rigorous.
Incorrect! Try again.
7When recommending remediation, which of the following is considered a best practice?
A.Recommending the purchase of the tester's own software product exclusively
B.Suggesting the organization takes the server offline permanently
C.Telling the client to 'Google the solution'
D.Providing a prioritized list of fixes based on risk severity
Correct Answer: Providing a prioritized list of fixes based on risk severity
Explanation:
Remediation advice should be prioritized (e.g., Critical, High, Medium, Low) so the organization knows which vulnerabilities pose the greatest immediate risk.
Incorrect! Try again.
8What is the primary function of a Proof of Concept (PoC) in a report?
A.To demonstrate the existence of a vulnerability with evidence (screenshots, code, logs)
B.To prove that the tester is skilled
C.To show the theoretical math behind an encryption algorithm
D.To increase the page count of the report
Correct Answer: To demonstrate the existence of a vulnerability with evidence (screenshots, code, logs)
Explanation:
A PoC provides concrete evidence that a vulnerability exists and allows the technical team to reproduce the issue to verify the fix.
Incorrect! Try again.
9Which metric is commonly used in reports to objectively score the severity of a vulnerability?
CVSS provides a standardized numerical score (0.0 to 10.0) reflecting the severity of a vulnerability based on its characteristics (exploitability, impact, etc.).
Incorrect! Try again.
10What is the definition of 'Cleanup' in the context of post-report delivery activities?
A.Wiping the client's database to ensure privacy
B.Removing all artifacts, shells, user accounts, and tools created or uploaded during the test
C.Deleting the final report from the client's inbox
D.Formatting the tester's hard drive
Correct Answer: Removing all artifacts, shells, user accounts, and tools created or uploaded during the test
Explanation:
Cleanup involves restoring the target environment to its pre-test state by removing any backdoors, scripts, or accounts left behind during the engagement.
Incorrect! Try again.
11Why is encryption important when delivering the final penetration test report?
A.It compresses the file size significantly
B.The report contains sensitive vulnerability data that could be exploited if intercepted
C.It prevents the client from printing the report
D.It is required by the HTTP protocol
Correct Answer: The report contains sensitive vulnerability data that could be exploited if intercepted
Explanation:
Penetration test reports contain a 'blueprint' of an organization's security weaknesses. If intercepted by an attacker, it would be devastating; therefore, secure delivery (PGP, encrypted zip, secure portal) is mandatory.
Incorrect! Try again.
12In an IoT environment, what is Binwalk primarily used for during the analysis phase?
A.Performing SQL injection on the cloud dashboard
B.Analyzing and extracting filesystem images from firmware binaries
C.Brute-forcing SSH passwords
D.Scanning for open WiFi networks
Correct Answer: Analyzing and extracting filesystem images from firmware binaries
Explanation:
Binwalk is a tool for searching a given binary image for embedded files and executable code, widely used for reverse engineering IoT firmware.
Incorrect! Try again.
13Which of the following describes a 'de-confliction' communication trigger?
A.Two penetration testers attack the same IP simultaneously
B.The report format conflicts with the printer settings
C.The tester argues with the client about payment
D.The client notices an attack signature and contacts the tester to confirm it is them
Correct Answer: The client notices an attack signature and contacts the tester to confirm it is them
Explanation:
De-confliction occurs when the Blue Team (defenders) detects suspicious activity and contacts the Red Team (testers) to verify if the activity is part of the authorized test or a real malicious actor.
Incorrect! Try again.
14When writing a report, avoiding False Positives is crucial because:
A.They damage the credibility of the tester and waste the client's resources
B.They are not supported by the CVSS scoring system
C.They make the report file size too large
D.They prevent the use of automated scanning tools
Correct Answer: They damage the credibility of the tester and waste the client's resources
Explanation:
Reporting a vulnerability that doesn't actually exist (false positive) wastes the remediation team's time and reduces trust in the tester's expertise.
Incorrect! Try again.
15What is the correct LaTeX representation for a CVSS temporal score calculation where ?
A.Score equals Base times TemporalMetric
B.
C.Score == Base * TemporalMetric
D.// Score = Base x TemporalMetric
Correct Answer:
Explanation:
In LaTeX, mathematical equations are enclosed in dollar signs. The \times command creates a multiplication symbol.
Incorrect! Try again.
16Which IoT attack vector involves analyzing power consumption or electromagnetic emissions to extract cryptographic keys?
A.Cross-Site Scripting
B.Side-Channel Attack
C.Buffer Overflow
D.SQL Injection
Correct Answer: Side-Channel Attack
Explanation:
Side-channel attacks exploit the physical implementation of a system (power, timing, sound, EM leaks) rather than bugs in the software logic.
Incorrect! Try again.
17Who is the primary audience for the Scope section of the report?
A.Both technical and management stakeholders
B.Only the external auditors
C.The marketing department
D.The end-users of the application
Correct Answer: Both technical and management stakeholders
Explanation:
The Scope section is critical for everyone to understand what was tested (and what was not) to frame the context of the findings and legal boundaries.
Incorrect! Try again.
18Serpico (SimplE RePort wrIting and COllaboration) aids penetration testers by:
A.Automatically hacking the target
B.Decrypting HTTPS traffic
C.Compiling C++ code
D.Generating report templates and managing findings databases
Correct Answer: Generating report templates and managing findings databases
Explanation:
Serpico is a report generation tool that allows testers to create reusable descriptions of findings and generate consistent reports quickly.
Incorrect! Try again.
19Which of the following is an example of an IoT-specific communication protocol that might be analyzed during a test?
MQTT is a lightweight messaging protocol commonly used in IoT for communication between sensors and brokers due to its low bandwidth usage.
Incorrect! Try again.
20During the presentation of findings, why is it important to begin with the Executive Summary?
A.It allows the tester to avoid answering technical questions
B.It is the only part of the report that matters
C.It sets the business context before diving into technical minutiae
D.It allows the technical staff to leave early
Correct Answer: It sets the business context before diving into technical minutiae
Explanation:
Starting with the executive summary ensures that decision-makers understand the overall risk posture and business impact before technical details are discussed.
Incorrect! Try again.
21What is Retesting (or Verification) in the post-report phase?
A.Running the exact same scan immediately after the first one
B.Testing the fixes implemented by the client to ensure the vulnerabilities are closed
C.Testing a different target that wasn't in the original scope
D.Verifying that the client has paid the invoice
Correct Answer: Testing the fixes implemented by the client to ensure the vulnerabilities are closed
Explanation:
Retesting is the process of verifying that the remediation steps taken by the client were effective and did not introduce new issues.
Incorrect! Try again.
22If a penetration tester finds default credentials (admin:admin) on an IoT device, how should this be categorized in the report?
Default credentials are a leading cause of IoT compromises (e.g., Mirai botnet). They allow immediate unauthorized access, often with administrative privileges.
Incorrect! Try again.
23Which component is NOT typically part of the Executive Summary?
A.Business Impact Analysis
B.Overall Security Posture
C.Key Recommendations (High Level)
D.Full Hex Dumps of Network Packets
Correct Answer: Full Hex Dumps of Network Packets
Explanation:
Hex dumps are highly technical data suitable for appendices or technical findings, not for the high-level Executive Summary.
Incorrect! Try again.
24What is the UART interface often used for in IoT penetration testing?
A.Serial communication for debugging and root shell access
B.Connecting to the cloud via 5G
C.Wireless charging
D.Displaying 4K video
Correct Answer: Serial communication for debugging and root shell access
Explanation:
UART (Universal Asynchronous Receiver-Transmitter) is a hardware interface often left open on IoT circuit boards, allowing testers to connect directly to the device console.
Incorrect! Try again.
25When recommending remediation for a vulnerability that cannot be patched immediately (e.g., legacy system), what should be suggested?
If a root fix (patch) isn't possible, compensating controls reduce the risk to an acceptable level by mitigating the likelihood or impact of exploitation.
Incorrect! Try again.
26Which formatting feature helps improve the readability of technical reports?
A.Using yellow text on a white background
B.Using a monospaced font for code snippets and command output
C.Using complex vocabulary to sound more intelligent
D.Writing the entire report in a single paragraph
Correct Answer: Using a monospaced font for code snippets and command output
Explanation:
Monospaced fonts (like Courier or Consolas) distinguish code/logs from narrative text, making it easier for engineers to read and copy commands.
Incorrect! Try again.
27What is the primary risk associated with JTAG (Joint Test Action Group) ports on IoT devices?
A.They allow direct access to the CPU and firmware memory
B.They are expensive to manufacture
C.They consume too much electricity
D.They interfere with WiFi signals
Correct Answer: They allow direct access to the CPU and firmware memory
Explanation:
JTAG is a hardware debugging interface. If left unsecured, it allows an attacker to dump firmware, manipulate memory, and bypass authentication.
Incorrect! Try again.
28In the context of reporting, what does 'Attribution' refer to?
A.Assigning credit to the penetration tester who found the bug
B.Identifying the specific hacker group responsible for an attack
C.Linking a finding to a specific host, IP, or URL
D.Listing the sources of open-source intelligence used
Correct Answer: Linking a finding to a specific host, IP, or URL
Explanation:
In a report, every finding must be attributed to the specific asset (IP, URL, Device) where it was found so the client knows what to fix.
Incorrect! Try again.
29Which of the following is a critical step in post-report delivery?
A.Publicly tweeting the vulnerabilities found
B.Keeping the VPN access open indefinitely
C.Sending the report to the client's competitors
D.Securely destroying client data stored on tester machines according to the retention policy
Correct Answer: Securely destroying client data stored on tester machines according to the retention policy
Explanation:
Testers must sanitize their own storage after the engagement (and retention period) to prevent data leaks of client information.
Incorrect! Try again.
30Why should a report include a 'Limitations' section?
A.To document constraints such as time limits, restricted scopes, or fragile systems that affected testing
B.To complain about the client's network speed
C.To list the tools the tester could not afford
D.To explain why the tester is not liable for anything
Correct Answer: To document constraints such as time limits, restricted scopes, or fragile systems that affected testing
Explanation:
Listing limitations protects the tester and informs the client that the absence of findings in a specific area might be due to constraints (e.g., 'Testing was performed only during off-hours').
Incorrect! Try again.
31What is the best way to present statistical data regarding findings (e.g., 5 High, 10 Medium, 20 Low)?
A.A complex algebraic equation
B.Visual charts (Pie charts or Bar graphs)
C.A long comma-separated string of text
D.Hidden metadata in the PDF
Correct Answer: Visual charts (Pie charts or Bar graphs)
Explanation:
Visual aids like charts provide an immediate, at-a-glance understanding of the volume and severity of findings for executive audiences.
Incorrect! Try again.
32When defining best practices for reports, the tone should be:
A.Accusatory toward the IT staff
B.Subjective and emotional
C.Objective, professional, and non-judgmental
D.Humorous and sarcastic
Correct Answer: Objective, professional, and non-judgmental
Explanation:
Reports must remain objective. The goal is to improve security, not to blame or shame the IT staff for the vulnerabilities found.
Incorrect! Try again.
33Which tool is commonly used to take screenshots and annotate them for reports?
A.Aircrack-ng
B.Netcat
C.Metasploit
D.Greenshot or Snagit
Correct Answer: Greenshot or Snagit
Explanation:
Tools like Greenshot or Snagit allow testers to capture evidence and quickly add arrows, boxes, or blur sensitive data, which is essential for clear reporting.
Incorrect! Try again.
34What is a 'Lessons Learned' meeting?
A.A session to install antivirus software
B.A meeting where the client lectures the tester
C.A training session for the penetration tester
D.A post-engagement meeting to discuss what went well, what didn't, and how to improve future processes
Correct Answer: A post-engagement meeting to discuss what went well, what didn't, and how to improve future processes
Explanation:
Also known as a debrief, this meeting helps refine the communication paths, scope definitions, and testing methodologies for future engagements.
Incorrect! Try again.
35In IoT security, what does 'Firmware extraction' allow a tester to do?
A.Physically break the device
B.Access the file system to look for hardcoded keys, configuration files, and binaries
C.Increase the device's Wi-Fi range
D.Bypass the need for electricity
Correct Answer: Access the file system to look for hardcoded keys, configuration files, and binaries
Explanation:
Once firmware is extracted, testers can statically analyze the file system for hardcoded API keys, admin passwords (/etc/shadow), or vulnerable software versions.
Incorrect! Try again.
36What is the formula often used to calculate Risk in a report context?
A.
B.
C.
D.
Correct Answer:
Explanation:
Risk is standardly defined as the likelihood of a threat event occurring multiplied by the impact that event would have on the organization.
Incorrect! Try again.
37Which of the following is an example of an 'Out-of-band' communication method?
A.Using an encrypted messaging app (Signal) or phone call instead of the client's corporate email
B.Using the client's internal chat server
C.Writing the report in the comments of the client's website
D.Sending an email through the compromised mail server
Correct Answer: Using an encrypted messaging app (Signal) or phone call instead of the client's corporate email
Explanation:
If the client's network is compromised, communicating via their internal email might alert the attacker. Out-of-band communication ensures secure delivery.
Incorrect! Try again.
38What is the primary security concern regarding Zigbee in IoT devices?
A.It uses excessive battery power
B.It requires a fiber optic connection
C.It is too fast for modern computers
D.Replay attacks and lack of encryption in older implementations
Correct Answer: Replay attacks and lack of encryption in older implementations
Explanation:
Zigbee is a wireless protocol. Vulnerabilities often include sniffing unencrypted traffic or capturing packets and replaying them (replay attack) to trigger actions like unlocking a smart lock.
Incorrect! Try again.
39When presenting findings, what does 'Reproducibility' ensure?
A.That the client's technical team can follow the steps to trigger the vulnerability themselves
B.That the vulnerability can never be fixed
C.That the report can be printed on any printer
D.That the vulnerability happens automatically every day
Correct Answer: That the client's technical team can follow the steps to trigger the vulnerability themselves
Explanation:
If a finding is not reproducible based on the report's instructions, developers cannot verify the issue or confirm that their patch works.
Incorrect! Try again.
40Which section of the report protects the penetration testing firm from legal liability?
A.Statement of Scope and Authorization
B.Tool Output
C.CVSS Calculator
D.Executive Summary
Correct Answer: Statement of Scope and Authorization
Explanation:
This section confirms that the testing was authorized, performed within the agreed boundaries, and serves as the 'Get Out of Jail Free' card.
Incorrect! Try again.
41What is a 'Living Document' in the context of long-term security engagements?
A.A document that contains biological viruses
B.A video recording of the test
C.A report that is continuously updated as new vulnerabilities are found and fixed (e.g., in Purple Teaming)
D.A report written on paper only
Correct Answer: A report that is continuously updated as new vulnerabilities are found and fixed (e.g., in Purple Teaming)
Explanation:
Unlike a point-in-time snapshot, a living document evolves with the security posture, often used in continuous testing or vulnerability management programs.
Incorrect! Try again.
42Why is it important to version control the report (e.g., v0.1, v1.0)?
A.To confuse the client
B.To increase the price of the report
C.To track changes between the draft, review, and final release
D.To use more hard drive space
Correct Answer: To track changes between the draft, review, and final release
Explanation:
Version control ensures that everyone is discussing the same set of data and tracks edits made during the Quality Assurance (QA) process.
Incorrect! Try again.
43Which of the following is a Post-Exploitation activity that must be reported?
A.Checking IP address reputation
B.Data exfiltration and lateral movement
C.Reading the privacy policy
D.Scanning ports
Correct Answer: Data exfiltration and lateral movement
Explanation:
Reporting on post-exploitation helps the client understand the impact—i.e., not just 'you have a vulnerability', but 'this vulnerability allowed us to pivot to the database'.
Incorrect! Try again.
44What is the recommended file format for the final deliverable report?
A.Executable file (.exe)
B.Proprietary format requiring a paid viewer
C.Microsoft Word (.docx) and PDF (.pdf)
D.Plain Text (.txt) only
Correct Answer: Microsoft Word (.docx) and PDF (.pdf)
Explanation:
PDF is standard for the immutable final record, while Word allows the client to copy/paste findings into their internal ticketing systems easily.
Incorrect! Try again.
45In IoT testing, what is 'SPI' (Serial Peripheral Interface)?
A.Synchronous Serial Communication interface used for short-distance communication in embedded systems
B.Standard Protocol for Internet
C.Stateful Packet Inspection
D.Security Policy Infrastructure
Correct Answer: Synchronous Serial Communication interface used for short-distance communication in embedded systems
Explanation:
Like UART and JTAG, SPI is a hardware bus used to communicate between microcontrollers and peripherals (like flash memory), often a target for physical sniffing.
Incorrect! Try again.
46What is the primary purpose of the 'Strategic Recommendations' section?
A.To list specific code patches
B.To sell hardware
C.To suggest long-term improvements like architecture changes, training, or policy updates
D.To criticize the CEO
Correct Answer: To suggest long-term improvements like architecture changes, training, or policy updates
Explanation:
While technical recommendations fix bugs, strategic recommendations address the root causes (e.g., 'Adopt a Secure SDLC' or 'Implement Multi-Factor Authentication globally').
Incorrect! Try again.
47Identify the incorrect statement regarding Report Quality Assurance (QA).
A.QA should check for grammar and spelling errors
B.QA is unnecessary if the tester is senior
C.QA verifies that the severity ratings are consistent
D.QA ensures the findings map to the scope
Correct Answer: QA is unnecessary if the tester is senior
Explanation:
QA is always necessary. Even senior testers make mistakes, and a second set of eyes ensures technical accuracy, clarity, and professionalism.
Incorrect! Try again.
48If a tester identifies a Zero-Day vulnerability in a third-party vendor product during a test, what is the best practice?
A.Follow Responsible Disclosure guidelines (notify vendor, wait for patch)
Best practice and ethics dictate notifying the vendor and allowing them time to fix the issue before public release, usually coordinated with the client.
Incorrect! Try again.
49What tool helps organize findings by mapping them to the MITRE ATT&CK framework in reports?
A.Paint
B.Calculator
C.Notepad
D.Vectr
Correct Answer: Vectr
Explanation:
Vectr (and similar tools) are designed to track red team activities and map them specifically to the MITRE ATT&CK matrix for reporting tactical progress.
Incorrect! Try again.
50When analyzing IoT network traffic, why might Bluetooth Low Energy (BLE) sniffing be required?
A.To intercept communications between a smartphone app and the IoT device
B.To speed up the internet connection
C.To decrypt SSL/TLS on the web server
D.To hack the satellite connection
Correct Answer: To intercept communications between a smartphone app and the IoT device
Explanation:
Many IoT devices are controlled via mobile apps using BLE. Sniffing this traffic (using tools like Ubertooth) can reveal commands, auth tokens, or cleartext data.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →