CPENT Network Penetration Testing Methodology

1. Which type of scan reveals open ports without completing the TCP three-way handshake?

Full connect scan

SYN stealth scan

FIN scan

Ping scan

2. True or False: Penetration testing should always be conducted without any prior notification to the organization.

True

False

3. What is the primary objective of the 'weaponization' phase in an attack framework?

Creating exploit payloads and delivery mechanisms

Writing the final report

Patching systems

Training security staff

4. Which tool is primarily used for vulnerability scanning in penetration assessments?

Nessus or OpenVAS

Notepad

Microsoft Word

Adobe Reader

5. In CPENT methodology, what does 'defense evasion' techniques help penetration testers accomplish?

Bypass security controls and detection mechanisms

Strengthen firewall rules

Patch vulnerabilities

Increase employee awareness

6. What is the significance of a 'zero-day' vulnerability in penetration testing?

A vulnerability unknown to vendors with no patch available

A vulnerability that was patched yesterday

A vulnerability only in legacy systems

A vulnerability in antivirus software

7. Which phase involves documenting findings, impact analysis, and remediation recommendations?

Reconnaissance

Reporting and Remediation

Exploitation

Enumeration

8. What does the term 'social engineering' encompass in penetration testing?

Manipulating people to divulge confidential information

Only phishing emails

Network packet analysis

Firewall configuration

9. Which of the following is a critical element of a penetration testing engagement?

Written authorization from the client

Informing all employees beforehand

Publishing results publicly

Avoiding documentation

10. In CPENT, what does 'privilege escalation' involve?

Gaining higher-level access rights on a compromised system

Notifying management of findings

Deleting audit logs

Scanning for open ports

11. Which phase of the CPENT methodology focuses on gathering information about the target without making direct contact?

Passive reconnaissance

Active reconnaissance

Exploitation

Reporting

12. What is the purpose of establishing persistence during post-exploitation?

To ensure continued access to the compromised system

To write documentation only

To immediately exit the network

To alert the security team

13. Which framework is commonly referenced in CPENT for penetration testing methodology?

OWASP Top 10

PTES (Penetration Testing Execution Standard)

ISO 27001

NIST Cybersecurity Framework only

14. In a CPENT assessment, what does 'lateral movement' refer to?

Moving between departments physically

Expanding access from one compromised system to other systems

Changing geographic locations

Rotating through different user accounts randomly

15. Which CVSS metric represents the complexity required to exploit a vulnerability?

Access Vector

Attack Complexity

Confidentiality Impact

Privileges Required

16. What is the primary goal of the enumeration phase?

To establish a backdoor on the target

To extract detailed information about network resources and services

To generate the final security report

To patch all discovered vulnerabilities

17. Which of the following is a key difference between vulnerability assessment and penetration testing?

Penetration testing includes exploitation; vulnerability assessment typically does not

Vulnerability assessment is more comprehensive

Penetration testing only identifies vulnerabilities

They are completely identical processes

18. In the CPENT methodology, what does the scanning phase identify?

Open ports, services, and potential vulnerabilities

The company's financial records

Employee personal information only

Physical security measures

19. Which tool is commonly used for DNS enumeration and reconnaissance?

Wireshark

Nmap

Nslookup

Metasploit

20. What is the primary purpose of footprinting in penetration testing?

Executing malicious code on target systems

Gathering preliminary information about the target organization

Writing the final security report

Patching vulnerabilities

CPENT Network Penetration Testing Methodology Quiz