1Which of the following best describes the primary goal of the Executive Summary in a penetration test report?
A.To provide raw scanning logs and exploit code to system administrators
B.To provide a step-by-step guide on how to patch software vulnerabilities
C.To explain the high-level business risks and impact to non-technical stakeholders
D.To list every specific command used during the engagement
Correct Answer: To explain the high-level business risks and impact to non-technical stakeholders
Explanation:
The Executive Summary is designed for C-level executives and management. It focuses on business risk, financial impact, and high-level findings rather than technical details.
Incorrect! Try again.
2In the context of communication triggers, what constitutes a Critical Finding that requires immediate notification?
A.Discovering a vulnerability that allows immediate remote code execution on a production server
B.Identifying an outdated version of jQuery with no known exploits
C.Locating a sub-domain that returns a 404 error
D.Finding a server that does not respond to ICMP ping requests
Correct Answer: Discovering a vulnerability that allows immediate remote code execution on a production server
Explanation:
A critical finding implies an imminent threat to the organization's assets or operations (like RCE on production) and requires immediate 'out-of-band' communication, bypassing the standard reporting timeline.
Incorrect! Try again.
3Which tool is specifically designed to facilitate collaborative reporting and vulnerability management during a penetration test?
A.Dradis
B.Nmap
C.Wireshark
D.John the Ripper
Correct Answer: Dradis
Explanation:
Dradis is an open-source reporting and collaboration platform that allows penetration testers to consolidate findings from various tools and generate reports.
Incorrect! Try again.
4When defining the Communication Path at the start of an engagement, what is the most important information to establish?
A.The brand of router used by the ISP
B.A contact list with primary and secondary contacts, including emergency numbers
C.The specific Linux kernel versions of the targets
D.The preferred font size for the final PDF report
Correct Answer: A contact list with primary and secondary contacts, including emergency numbers
Explanation:
Establishing a clear communication path with a contact list ensures that if a critical issue arises or the test causes a denial of service, the tester knows exactly who to call immediately.
Incorrect! Try again.
5Which section of a penetration test report is primarily intended for system administrators and developers?
A.Technical Findings and Remediation
B.Executive Summary
C.Document Control
D.Statement of Scope
Correct Answer: Technical Findings and Remediation
Explanation:
The Technical Findings section includes detailed reproduction steps, technical analysis, specific CVEs, and remediation advice required by technical staff to fix the issues.
Incorrect! Try again.
6What is the purpose of the 'Methodology' section in a penetration test report?
A.To list the hardware specifications of the tester's laptop
B.To list the prices of the tools used
C.To describe the approach, standards (e.g., PTES, OWASP), and phases undertaken during the test
D.To provide a biography of the penetration tester
Correct Answer: To describe the approach, standards (e.g., PTES, OWASP), and phases undertaken during the test
Explanation:
The Methodology section outlines the standards and logic followed (such as OSSTMM or PTES) to ensure the client understands how the test was conducted and that it was rigorous.
Incorrect! Try again.
7When recommending remediation, which of the following is considered a best practice?
A.Providing a prioritized list of fixes based on risk severity
B.Recommending the purchase of the tester's own software product exclusively
C.Telling the client to 'Google the solution'
D.Suggesting the organization takes the server offline permanently
Correct Answer: Providing a prioritized list of fixes based on risk severity
Explanation:
Remediation advice should be prioritized (e.g., Critical, High, Medium, Low) so the organization knows which vulnerabilities pose the greatest immediate risk.
Incorrect! Try again.
8What is the primary function of a Proof of Concept (PoC) in a report?
A.To show the theoretical math behind an encryption algorithm
B.To prove that the tester is skilled
C.To demonstrate the existence of a vulnerability with evidence (screenshots, code, logs)
D.To increase the page count of the report
Correct Answer: To demonstrate the existence of a vulnerability with evidence (screenshots, code, logs)
Explanation:
A PoC provides concrete evidence that a vulnerability exists and allows the technical team to reproduce the issue to verify the fix.
Incorrect! Try again.
9Which metric is commonly used in reports to objectively score the severity of a vulnerability?
CVSS provides a standardized numerical score (0.0 to 10.0) reflecting the severity of a vulnerability based on its characteristics (exploitability, impact, etc.).
Incorrect! Try again.
10What is the definition of 'Cleanup' in the context of post-report delivery activities?
A.Deleting the final report from the client's inbox
B.Removing all artifacts, shells, user accounts, and tools created or uploaded during the test
C.Wiping the client's database to ensure privacy
D.Formatting the tester's hard drive
Correct Answer: Removing all artifacts, shells, user accounts, and tools created or uploaded during the test
Explanation:
Cleanup involves restoring the target environment to its pre-test state by removing any backdoors, scripts, or accounts left behind during the engagement.
Incorrect! Try again.
11Why is encryption important when delivering the final penetration test report?
A.It is required by the HTTP protocol
B.The report contains sensitive vulnerability data that could be exploited if intercepted
C.It compresses the file size significantly
D.It prevents the client from printing the report
Correct Answer: The report contains sensitive vulnerability data that could be exploited if intercepted
Explanation:
Penetration test reports contain a 'blueprint' of an organization's security weaknesses. If intercepted by an attacker, it would be devastating; therefore, secure delivery (PGP, encrypted zip, secure portal) is mandatory.
Incorrect! Try again.
12In an IoT environment, what is Binwalk primarily used for during the analysis phase?
A.Brute-forcing SSH passwords
B.Analyzing and extracting filesystem images from firmware binaries
C.Scanning for open WiFi networks
D.Performing SQL injection on the cloud dashboard
Correct Answer: Analyzing and extracting filesystem images from firmware binaries
Explanation:
Binwalk is a tool for searching a given binary image for embedded files and executable code, widely used for reverse engineering IoT firmware.
Incorrect! Try again.
13Which of the following describes a 'de-confliction' communication trigger?
A.Two penetration testers attack the same IP simultaneously
B.The report format conflicts with the printer settings
C.The client notices an attack signature and contacts the tester to confirm it is them
D.The tester argues with the client about payment
Correct Answer: The client notices an attack signature and contacts the tester to confirm it is them
Explanation:
De-confliction occurs when the Blue Team (defenders) detects suspicious activity and contacts the Red Team (testers) to verify if the activity is part of the authorized test or a real malicious actor.
Incorrect! Try again.
14When writing a report, avoiding False Positives is crucial because:
A.They damage the credibility of the tester and waste the client's resources
B.They prevent the use of automated scanning tools
C.They make the report file size too large
D.They are not supported by the CVSS scoring system
Correct Answer: They damage the credibility of the tester and waste the client's resources
Explanation:
Reporting a vulnerability that doesn't actually exist (false positive) wastes the remediation team's time and reduces trust in the tester's expertise.
Incorrect! Try again.
15What is the correct LaTeX representation for a CVSS temporal score calculation where ?
A.// Score = Base x TemporalMetric
B.Score equals Base times TemporalMetric
C.
D.Score == Base * TemporalMetric
Correct Answer:
Explanation:
In LaTeX, mathematical equations are enclosed in dollar signs. The \times command creates a multiplication symbol.
Incorrect! Try again.
16Which IoT attack vector involves analyzing power consumption or electromagnetic emissions to extract cryptographic keys?
A.Buffer Overflow
B.SQL Injection
C.Side-Channel Attack
D.Cross-Site Scripting
Correct Answer: Side-Channel Attack
Explanation:
Side-channel attacks exploit the physical implementation of a system (power, timing, sound, EM leaks) rather than bugs in the software logic.
Incorrect! Try again.
17Who is the primary audience for the Scope section of the report?
A.The end-users of the application
B.The marketing department
C.Both technical and management stakeholders
D.Only the external auditors
Correct Answer: Both technical and management stakeholders
Explanation:
The Scope section is critical for everyone to understand what was tested (and what was not) to frame the context of the findings and legal boundaries.
Incorrect! Try again.
18Serpico (SimplE RePort wrIting and COllaboration) aids penetration testers by:
A.Decrypting HTTPS traffic
B.Automatically hacking the target
C.Generating report templates and managing findings databases
D.Compiling C++ code
Correct Answer: Generating report templates and managing findings databases
Explanation:
Serpico is a report generation tool that allows testers to create reusable descriptions of findings and generate consistent reports quickly.
Incorrect! Try again.
19Which of the following is an example of an IoT-specific communication protocol that might be analyzed during a test?
MQTT is a lightweight messaging protocol commonly used in IoT for communication between sensors and brokers due to its low bandwidth usage.
Incorrect! Try again.
20During the presentation of findings, why is it important to begin with the Executive Summary?
A.It allows the technical staff to leave early
B.It is the only part of the report that matters
C.It allows the tester to avoid answering technical questions
D.It sets the business context before diving into technical minutiae
Correct Answer: It sets the business context before diving into technical minutiae
Explanation:
Starting with the executive summary ensures that decision-makers understand the overall risk posture and business impact before technical details are discussed.
Incorrect! Try again.
21What is Retesting (or Verification) in the post-report phase?
A.Verifying that the client has paid the invoice
B.Testing a different target that wasn't in the original scope
C.Testing the fixes implemented by the client to ensure the vulnerabilities are closed
D.Running the exact same scan immediately after the first one
Correct Answer: Testing the fixes implemented by the client to ensure the vulnerabilities are closed
Explanation:
Retesting is the process of verifying that the remediation steps taken by the client were effective and did not introduce new issues.
Incorrect! Try again.
22If a penetration tester finds default credentials (admin:admin) on an IoT device, how should this be categorized in the report?
Default credentials are a leading cause of IoT compromises (e.g., Mirai botnet). They allow immediate unauthorized access, often with administrative privileges.
Incorrect! Try again.
23Which component is NOT typically part of the Executive Summary?
A.Key Recommendations (High Level)
B.Full Hex Dumps of Network Packets
C.Business Impact Analysis
D.Overall Security Posture
Correct Answer: Full Hex Dumps of Network Packets
Explanation:
Hex dumps are highly technical data suitable for appendices or technical findings, not for the high-level Executive Summary.
Incorrect! Try again.
24What is the UART interface often used for in IoT penetration testing?
A.Wireless charging
B.Connecting to the cloud via 5G
C.Displaying 4K video
D.Serial communication for debugging and root shell access
Correct Answer: Serial communication for debugging and root shell access
Explanation:
UART (Universal Asynchronous Receiver-Transmitter) is a hardware interface often left open on IoT circuit boards, allowing testers to connect directly to the device console.
Incorrect! Try again.
25When recommending remediation for a vulnerability that cannot be patched immediately (e.g., legacy system), what should be suggested?
If a root fix (patch) isn't possible, compensating controls reduce the risk to an acceptable level by mitigating the likelihood or impact of exploitation.
Incorrect! Try again.
26Which formatting feature helps improve the readability of technical reports?
A.Writing the entire report in a single paragraph
B.Using complex vocabulary to sound more intelligent
C.Using a monospaced font for code snippets and command output
D.Using yellow text on a white background
Correct Answer: Using a monospaced font for code snippets and command output
Explanation:
Monospaced fonts (like Courier or Consolas) distinguish code/logs from narrative text, making it easier for engineers to read and copy commands.
Incorrect! Try again.
27What is the primary risk associated with JTAG (Joint Test Action Group) ports on IoT devices?
A.They interfere with WiFi signals
B.They allow direct access to the CPU and firmware memory
C.They consume too much electricity
D.They are expensive to manufacture
Correct Answer: They allow direct access to the CPU and firmware memory
Explanation:
JTAG is a hardware debugging interface. If left unsecured, it allows an attacker to dump firmware, manipulate memory, and bypass authentication.
Incorrect! Try again.
28In the context of reporting, what does 'Attribution' refer to?
A.Identifying the specific hacker group responsible for an attack
B.Assigning credit to the penetration tester who found the bug
C.Listing the sources of open-source intelligence used
D.Linking a finding to a specific host, IP, or URL
Correct Answer: Linking a finding to a specific host, IP, or URL
Explanation:
In a report, every finding must be attributed to the specific asset (IP, URL, Device) where it was found so the client knows what to fix.
Incorrect! Try again.
29Which of the following is a critical step in post-report delivery?
A.Securely destroying client data stored on tester machines according to the retention policy
B.Keeping the VPN access open indefinitely
C.Publicly tweeting the vulnerabilities found
D.Sending the report to the client's competitors
Correct Answer: Securely destroying client data stored on tester machines according to the retention policy
Explanation:
Testers must sanitize their own storage after the engagement (and retention period) to prevent data leaks of client information.
Incorrect! Try again.
30Why should a report include a 'Limitations' section?
A.To list the tools the tester could not afford
B.To complain about the client's network speed
C.To explain why the tester is not liable for anything
D.To document constraints such as time limits, restricted scopes, or fragile systems that affected testing
Correct Answer: To document constraints such as time limits, restricted scopes, or fragile systems that affected testing
Explanation:
Listing limitations protects the tester and informs the client that the absence of findings in a specific area might be due to constraints (e.g., 'Testing was performed only during off-hours').
Incorrect! Try again.
31What is the best way to present statistical data regarding findings (e.g., 5 High, 10 Medium, 20 Low)?
A.Hidden metadata in the PDF
B.A long comma-separated string of text
C.Visual charts (Pie charts or Bar graphs)
D.A complex algebraic equation
Correct Answer: Visual charts (Pie charts or Bar graphs)
Explanation:
Visual aids like charts provide an immediate, at-a-glance understanding of the volume and severity of findings for executive audiences.
Incorrect! Try again.
32When defining best practices for reports, the tone should be:
A.Accusatory toward the IT staff
B.Objective, professional, and non-judgmental
C.Humorous and sarcastic
D.Subjective and emotional
Correct Answer: Objective, professional, and non-judgmental
Explanation:
Reports must remain objective. The goal is to improve security, not to blame or shame the IT staff for the vulnerabilities found.
Incorrect! Try again.
33Which tool is commonly used to take screenshots and annotate them for reports?
A.Aircrack-ng
B.Metasploit
C.Netcat
D.Greenshot or Snagit
Correct Answer: Greenshot or Snagit
Explanation:
Tools like Greenshot or Snagit allow testers to capture evidence and quickly add arrows, boxes, or blur sensitive data, which is essential for clear reporting.
Incorrect! Try again.
34What is a 'Lessons Learned' meeting?
A.A session to install antivirus software
B.A post-engagement meeting to discuss what went well, what didn't, and how to improve future processes
C.A meeting where the client lectures the tester
D.A training session for the penetration tester
Correct Answer: A post-engagement meeting to discuss what went well, what didn't, and how to improve future processes
Explanation:
Also known as a debrief, this meeting helps refine the communication paths, scope definitions, and testing methodologies for future engagements.
Incorrect! Try again.
35In IoT security, what does 'Firmware extraction' allow a tester to do?
A.Physically break the device
B.Bypass the need for electricity
C.Increase the device's Wi-Fi range
D.Access the file system to look for hardcoded keys, configuration files, and binaries
Correct Answer: Access the file system to look for hardcoded keys, configuration files, and binaries
Explanation:
Once firmware is extracted, testers can statically analyze the file system for hardcoded API keys, admin passwords (/etc/shadow), or vulnerable software versions.
Incorrect! Try again.
36What is the formula often used to calculate Risk in a report context?
A.
B.
C.
D.
Correct Answer:
Explanation:
Risk is standardly defined as the likelihood of a threat event occurring multiplied by the impact that event would have on the organization.
Incorrect! Try again.
37Which of the following is an example of an 'Out-of-band' communication method?
A.Sending an email through the compromised mail server
B.Using the client's internal chat server
C.Using an encrypted messaging app (Signal) or phone call instead of the client's corporate email
D.Writing the report in the comments of the client's website
Correct Answer: Using an encrypted messaging app (Signal) or phone call instead of the client's corporate email
Explanation:
If the client's network is compromised, communicating via their internal email might alert the attacker. Out-of-band communication ensures secure delivery.
Incorrect! Try again.
38What is the primary security concern regarding Zigbee in IoT devices?
A.It is too fast for modern computers
B.It requires a fiber optic connection
C.Replay attacks and lack of encryption in older implementations
D.It uses excessive battery power
Correct Answer: Replay attacks and lack of encryption in older implementations
Explanation:
Zigbee is a wireless protocol. Vulnerabilities often include sniffing unencrypted traffic or capturing packets and replaying them (replay attack) to trigger actions like unlocking a smart lock.
Incorrect! Try again.
39When presenting findings, what does 'Reproducibility' ensure?
A.That the vulnerability happens automatically every day
B.That the vulnerability can never be fixed
C.That the report can be printed on any printer
D.That the client's technical team can follow the steps to trigger the vulnerability themselves
Correct Answer: That the client's technical team can follow the steps to trigger the vulnerability themselves
Explanation:
If a finding is not reproducible based on the report's instructions, developers cannot verify the issue or confirm that their patch works.
Incorrect! Try again.
40Which section of the report protects the penetration testing firm from legal liability?
A.Statement of Scope and Authorization
B.Executive Summary
C.Tool Output
D.CVSS Calculator
Correct Answer: Statement of Scope and Authorization
Explanation:
This section confirms that the testing was authorized, performed within the agreed boundaries, and serves as the 'Get Out of Jail Free' card.
Incorrect! Try again.
41What is a 'Living Document' in the context of long-term security engagements?
A.A video recording of the test
B.A report that is continuously updated as new vulnerabilities are found and fixed (e.g., in Purple Teaming)
C.A report written on paper only
D.A document that contains biological viruses
Correct Answer: A report that is continuously updated as new vulnerabilities are found and fixed (e.g., in Purple Teaming)
Explanation:
Unlike a point-in-time snapshot, a living document evolves with the security posture, often used in continuous testing or vulnerability management programs.
Incorrect! Try again.
42Why is it important to version control the report (e.g., v0.1, v1.0)?
A.To use more hard drive space
B.To track changes between the draft, review, and final release
C.To increase the price of the report
D.To confuse the client
Correct Answer: To track changes between the draft, review, and final release
Explanation:
Version control ensures that everyone is discussing the same set of data and tracks edits made during the Quality Assurance (QA) process.
Incorrect! Try again.
43Which of the following is a Post-Exploitation activity that must be reported?
A.Scanning ports
B.Reading the privacy policy
C.Data exfiltration and lateral movement
D.Checking IP address reputation
Correct Answer: Data exfiltration and lateral movement
Explanation:
Reporting on post-exploitation helps the client understand the impact—i.e., not just 'you have a vulnerability', but 'this vulnerability allowed us to pivot to the database'.
Incorrect! Try again.
44What is the recommended file format for the final deliverable report?
A.Proprietary format requiring a paid viewer
B.Microsoft Word (.docx) and PDF (.pdf)
C.Plain Text (.txt) only
D.Executable file (.exe)
Correct Answer: Microsoft Word (.docx) and PDF (.pdf)
Explanation:
PDF is standard for the immutable final record, while Word allows the client to copy/paste findings into their internal ticketing systems easily.
Incorrect! Try again.
45In IoT testing, what is 'SPI' (Serial Peripheral Interface)?
A.Standard Protocol for Internet
B.Stateful Packet Inspection
C.Synchronous Serial Communication interface used for short-distance communication in embedded systems
D.Security Policy Infrastructure
Correct Answer: Synchronous Serial Communication interface used for short-distance communication in embedded systems
Explanation:
Like UART and JTAG, SPI is a hardware bus used to communicate between microcontrollers and peripherals (like flash memory), often a target for physical sniffing.
Incorrect! Try again.
46What is the primary purpose of the 'Strategic Recommendations' section?
A.To criticize the CEO
B.To sell hardware
C.To suggest long-term improvements like architecture changes, training, or policy updates
D.To list specific code patches
Correct Answer: To suggest long-term improvements like architecture changes, training, or policy updates
Explanation:
While technical recommendations fix bugs, strategic recommendations address the root causes (e.g., 'Adopt a Secure SDLC' or 'Implement Multi-Factor Authentication globally').
Incorrect! Try again.
47Identify the incorrect statement regarding Report Quality Assurance (QA).
A.QA should check for grammar and spelling errors
B.QA is unnecessary if the tester is senior
C.QA ensures the findings map to the scope
D.QA verifies that the severity ratings are consistent
Correct Answer: QA is unnecessary if the tester is senior
Explanation:
QA is always necessary. Even senior testers make mistakes, and a second set of eyes ensures technical accuracy, clarity, and professionalism.
Incorrect! Try again.
48If a tester identifies a Zero-Day vulnerability in a third-party vendor product during a test, what is the best practice?
A.Follow Responsible Disclosure guidelines (notify vendor, wait for patch)
Best practice and ethics dictate notifying the vendor and allowing them time to fix the issue before public release, usually coordinated with the client.
Incorrect! Try again.
49What tool helps organize findings by mapping them to the MITRE ATT&CK framework in reports?
A.Vectr
B.Calculator
C.Paint
D.Notepad
Correct Answer: Vectr
Explanation:
Vectr (and similar tools) are designed to track red team activities and map them specifically to the MITRE ATT&CK matrix for reporting tactical progress.
Incorrect! Try again.
50When analyzing IoT network traffic, why might Bluetooth Low Energy (BLE) sniffing be required?
A.To intercept communications between a smartphone app and the IoT device
B.To speed up the internet connection
C.To hack the satellite connection
D.To decrypt SSL/TLS on the web server
Correct Answer: To intercept communications between a smartphone app and the IoT device
Explanation:
Many IoT devices are controlled via mobile apps using BLE. Sniffing this traffic (using tools like Ubertooth) can reveal commands, auth tokens, or cleartext data.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →