PenTest+ V2 PTES Methodology Overview Quiz

1. In the Vulnerability Analysis phase, what is the relationship between risk rating and remediation priority?

Higher risk vulnerabilities should be remediated first

All vulnerabilities require immediate patching regardless of risk

Risk rating is irrelevant to remediation planning

Only critical vulnerabilities need documentation

2. Which of the following best reflects ethical penetration testing principles in PTES?

Testing without client authorization if vulnerabilities are suspected

Staying within scope, following RoE, and minimizing system impact

Exploiting all vulnerabilities to demonstrate capability

Retaining access credentials for future assessments

Submit

4. True or False: A penetration test is considered complete once exploitation of a vulnerability is demonstrated, regardless of further investigation.

True

False

5. Which statement best describes the iterative nature of PTES?

Each phase must be completed before the next begins

Phases may overlap and testers may return to earlier phases with new information

All phases occur simultaneously

Only the Reporting phase is iterative

Submit

7. What distinguishes passive reconnaissance from active reconnaissance in Intelligence Gathering?

Passive uses direct network requests; active does not

Passive avoids direct contact; active sends network traffic to the target

Passive is less accurate than active

Active reconnaissance is always illegal

8. True or False: The Rules of Engagement should be reviewed and signed by both the tester and client before any testing begins.

True

False

9. Which PTES phase requires the most careful adherence to legal and ethical boundaries?

Intelligence Gathering

Scanning & Enumeration

Exploitation and Post-Exploitation

Reporting

Submit

11. Which PTES phase involves gathering information about the target organization through public sources?

Pre-engagement Interactions

Intelligence Gathering

Threat Modeling

Exploitation

12. True or False: Social engineering is a valid technique within PTES if included in the Rules of Engagement.

True

False

13. What is the primary goal of Intelligence Gathering in PTES?

To identify all active hosts and services

To collect data about the target's infrastructure, people, and processes

To exploit known vulnerabilities

To document compliance gaps

14. Which of the following are key components of the Reporting phase? (Select all that apply)

Executive summary with business risk context

Technical findings with proof-of-concept details

Unauthorized system access attempts

Remediation recommendations prioritized by risk

Submit

15. True or False: The PTES methodology allows penetration testers to exceed the scope defined in the Rules of Engagement if they discover critical vulnerabilities.

True

False

Submit

17. Post-Exploitation activities primarily serve to demonstrate what?

The attacker's technical skills

Business impact and data sensitivity of compromised systems

The need for complete system replacement

Compliance with regulatory standards

18. Which PTES phase focuses on attempting to access systems using identified vulnerabilities?

Vulnerability Analysis

Exploitation

Reporting

Intelligence Gathering

19. The Pre-engagement Interactions phase establishes which critical document?

Vulnerability assessment report

Rules of Engagement (RoE) and scope

Executive summary

Remediation timeline

20. What is the primary purpose of the Scanning & Enumeration phase in PTES?

To identify vulnerabilities and active services

To document all findings in a final report

To establish the scope and rules of engagement

To gain administrative access to systems

PenTest+ V2 PTES Methodology Overview Quiz

1. In the Vulnerability Analysis phase, what is the relationship between risk rating and remediation priority?

2.

What first name or nickname would you like us to use?

2. Which of the following best reflects ethical penetration testing principles in PTES?

3. The primary deliverable of a PTES engagement is the ____.

4. True or False: A penetration test is considered complete once exploitation of a vulnerability is demonstrated, regardless of further investigation.

5. Which statement best describes the iterative nature of PTES?

6. In PTES reporting, findings should be prioritized by ____.

7. What distinguishes passive reconnaissance from active reconnaissance in Intelligence Gathering?

8. True or False: The Rules of Engagement should be reviewed and signed by both the tester and client before any testing begins.

9. Which PTES phase requires the most careful adherence to legal and ethical boundaries?

10. Proper documentation during Post-Exploitation helps demonstrate ____.

11. Which PTES phase involves gathering information about the target organization through public sources?

12. True or False: Social engineering is a valid technique within PTES if included in the Rules of Engagement.

13. What is the primary goal of Intelligence Gathering in PTES?

14. Which of the following are key components of the Reporting phase? (Select all that apply)

15. True or False: The PTES methodology allows penetration testers to exceed the scope defined in the Rules of Engagement if they discover critical vulnerabilities.

16. In PTES, Vulnerability Analysis differs from Scanning & Enumeration because it ____.

17. Post-Exploitation activities primarily serve to demonstrate what?

18. Which PTES phase focuses on attempting to access systems using identified vulnerabilities?

19. The Pre-engagement Interactions phase establishes which critical document?

20. What is the primary purpose of the Scanning & Enumeration phase in PTES?