HikeLetter | PMP Training & Certification Online Course | Project Management Learning

1

During an authorized web application test, consider: Before starting a penetration test, what is the most important prerequisite?

A. Written authorization, a defined scope, rules of engagement, and agreed safety limits. B. Continue testing outside scope if the potential finding seems important. C. Collect as much real customer data as possible to make the report stronger. D. Ignore the rules of engagement if a faster technique is available.

2

During an authorized web application test, consider: A tester discovers a production system outside the approved scope. What should they do?

A. Ignore the rules of engagement if a faster technique is available. B. Stop testing that system and seek written scope clarification before proceeding. C. Continue testing outside scope if the potential finding seems important. D. Collect as much real customer data as possible to make the report stronger.

3

During an authorized web application test, consider: Which activity is most appropriate during reconnaissance?

A. Collect as much real customer data as possible to make the report stronger. B. Ignore the rules of engagement if a faster technique is available. C. Collect publicly available information about the approved target and document sources. D. Continue testing outside scope if the potential finding seems important.

4

During an authorized web application test, consider: A scanner reports a critical vulnerability. What should the tester do next?

A. Continue testing outside scope if the potential finding seems important. B. Collect as much real customer data as possible to make the report stronger. C. Ignore the rules of engagement if a faster technique is available. D. Validate the finding safely and collect evidence sufficient to demonstrate impact.

5

During an authorized web application test, consider: A test may disrupt a business-critical service. What is the best action?

A. Follow the rules of engagement, use approved low-impact methods, and coordinate with the client before risky testing. B. Continue testing outside scope if the potential finding seems important. C. Collect as much real customer data as possible to make the report stronger. D. Ignore the rules of engagement if a faster technique is available.

6

During an authorized web application test, consider: A password hash is obtained during an authorized test. What is the appropriate handling?

A. Ignore the rules of engagement if a faster technique is available. B. Protect the evidence, restrict access, and perform only the password analysis explicitly authorized. C. Continue testing outside scope if the potential finding seems important. D. Collect as much real customer data as possible to make the report stronger.

7

During an authorized web application test, consider: A tester finds a likely SQL injection issue. What should they do?

A. Collect as much real customer data as possible to make the report stronger. B. Ignore the rules of engagement if a faster technique is available. C. Use a controlled, minimally invasive validation method within scope and document the evidence. D. Continue testing outside scope if the potential finding seems important.

8

During an authorized web application test, consider: A web application exposes session cookies without secure transport. What is a suitable recommendation?

A. Collect as much real customer data as possible to make the report stronger. B. Ignore the rules of engagement if a faster technique is available. C. Enforce HTTPS and appropriate cookie attributes, including Secure and HttpOnly where applicable, with suitable SameSite settings. D. Continue testing outside scope if the potential finding seems important.

9

During an authorized web application test, consider: A client asks the tester to delete logs to avoid detection during an internal test. What should guide the response?

A. Continue testing outside scope if the potential finding seems important. B. Collect as much real customer data as possible to make the report stronger. C. Ignore the rules of engagement if a faster technique is available. D. Follow the written rules of engagement and evidence-handling requirements; do not alter logs unless explicitly authorized.

10

During an authorized web application test, consider: Which technique is appropriate for checking whether a discovered service is exposed?

A. Use authorized service enumeration and verify the service and version with proportionate, non-disruptive methods. B. Continue testing outside scope if the potential finding seems important. C. Collect as much real customer data as possible to make the report stronger. D. Ignore the rules of engagement if a faster technique is available.

PenTest+

Overview

Course Description

Course Questions