Second Part

Which of the following is a key legal requirement before starting a penetration test?

• Performing reconnaissance without informing the client

• Obtaining explicit informed consent from the organization

• Only testing public-facing systems without permission

• Sharing test results with third parties for verification

Which activity aligns with the Reporting and Transparency principle?

• Avoiding vulnerability disclosure to keep systems secure

• Providing detailed findings and remediation steps to the client

• Conducting stealth testing without client awareness

• Expanding the scope of testing without permission

n the context of penetration testing, compliance with EG-CERT regulations in Egypt primarily aims to:

• Secure only cloud-based systems from cyber threats.

• Ensure adherence to national cybersecurity requirements.

• Protect personal data of EU citizens.

• Prevent physical theft of IT equipment.

Which compliance standard is specifically designed to secure payment systems and protect cardholder data?

• GDPR

• EG-CERT

• PCI-DSS

• ISO 27001

Which of the following is a primary objective of PCI-DSS compliance?

• Preventing phishing attacks targeting employees

• Ensuring compliance only for organizations in the financial sector

• Protecting sensitive cardholder data such as card numbers and expiration dates

• Encrypting all email communications between customers and merchants

During a PCI-DSS compliance audit, a penetration test reveals several vulnerabilities. What is the correct next step to maintain compliance?

• Ignore low-severity vulnerabilities as they do not affect compliance q

• Remediate identified vulnerabilities based on penetration testing recommendations

• Document vulnerabilities without implementing changes

• Perform penetration testing only after the annual compliance review

In the context of Cobalt Strike, which phase involves creating a persistent link between the attacker and the compromised host?

• Lateral Movement

• Data Exfiltration

• Command and Control

• Reconnaissance

Which of the following BEST explains why "Clearly Define Scope" is critical in penetration testing?

• It ensures testers can use any available tools without restriction

• It prevents testers from accidentally targeting systems outside the agreed boundaries

• It eliminates the need for documentation after the test

• It allows penetration testing to be performed without management approval

In a penetration test, which practice MOST helps ensure that the test is systematic, repeatable, and covers all necessary areas?

• Using only automated vulnerability scanners

• Limiting the test to reconnaissance and scanning phases

• Running exploits immediately without prior assessment

• Following a structured methodology

A penetration testing team ensures that their testing does not impact critical business operations. This aligns with which ethical guideline?

• Informed Consent

• Reporting and Transparency

• Non-Disruptive Activities

• Scope and Boundaries