eJPT Planning and Scoping 5

Question 1

What is the primary difference between a vulnerability assessment and a penetration test?

Accepted Answer

A vulnerability assessment identifies weaknesses while a penetration test actively exploits them to demonstrate real-world impact

Answer

Vulnerability assessments identify and classify weaknesses, while penetration tests go further by exploiting vulnerabilities to prove they are truly exploitable.

Question 2

A company wants to test how well their security team detects and responds to attacks. Which engagement type is MOST appropriate?

Accepted Answer

Red team engagement

Answer

Red team engagements are specifically designed to test an organization's detection and response capabilities by simulating realistic adversary behavior.

Question 3

Which of the following items should be included in the initial kickoff meeting for a penetration testing engagement?

Accepted Answer

Confirmation of scope, testing windows, emergency contacts, and escalation procedures

Answer

The kickoff meeting should establish mutual understanding of scope boundaries, authorized timeframes, key contacts, and escalation procedures before testing begins.

Question 4

Why is it important for a penetration tester to understand the client's compliance requirements (e.g., PCI-DSS, HIPAA) during the planning phase?

Accepted Answer

To tailor the testing methodology and report format to meet specific compliance standards and audit requirements

Answer

Compliance frameworks often dictate specific testing requirements, scope, and reporting formats that must be followed for the results to satisfy auditors.

Question 5

During planning, the client provides a subnet that includes a hospital patient monitoring system. What should the tester do?

Accepted Answer

Flag it immediately and discuss with the client whether to exclude critical medical systems from scope due to safety risks

Answer

Critical safety systems like medical equipment should be explicitly discussed and likely excluded from scope to prevent risk to human life.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Planning and Scoping 5