SOLUTIONS MANUAL
** All Chapters included
** Review Questions
** Activities & Case Projects
,Table of Contents are given below
Chapter 1. Introduction to Penetration Testing
Chapter 2. Setting Up a Penetration-Testing Lab
Chapter 3. Engagement Management
Chapter 4. Reporting and Communication
Chapter 5. Reconnaissance and Enumeration
Chapter 6. Performing Vulnerability Scanning
Chapter 7. Exploitation Methods and Tools
Chapter 8. Network Attacks and Attack Vectors
Chapter 9. Wireless and Specialized Systems Attack Vectors and Attacks
Chapter 10. Application-Based Attack Vectors and Attacks
Chapter 11. Host Attack Vectors and Cloud Technologies Attacks
Chapter 12. Social Engineering and Physical Attacks
Chapter 13. Writing and Understanding Code
Chapter 14. The Final Penetration-Testing Project
,Fehler! Verwenden Sie die Registerkarte 'Start', um Title dem Text zuzuweisen, der hier angezeigt werden soll.: Wilson, PenTest+ Guide to Penetration Testing
2e 2027, 9798214410180;
Chapter 1: Introduction to Penetration Testing
Solution and Answer Guide
WILSON, COMPTIA PENTEST+ GUIDE TO PENETRATION TESTING 2e 2027, 9798214410180; CHAPTER 1:
INTRODUCTION TO PENETRATION TESTING
TABLE OF CONTENTS
Review Questions ..............................................................................................................................1
Activities ...........................................................................................................................................4
Activity 1-1: Determining the Corporate Need for Penetration Testers .................................................. 4
Activity 1-2: Examining the Top 25 Most Dangerous Programming Errors .............................................. 4
Activity 1-3: Identifying Computer Statutes in Your State, Province, or County ...................................... 4
Activity 1-4: Examining Federal and International Computer Crime Laws ............................................... 5
Case Projects .....................................................................................................................................5
Case Project 1-1: Determining Legal Requirements for Penetration Testing ........................................... 5
Case Project 1-2: Researching Hacktivists at Work................................................................................... 6
REVIEW QUESTIONS
1. What are two other terms for penetration testing?
a. Vulnerability testing
b. Pen testing
c. Ethical hacking
d. Blue teaming
Answer: b, c
Penetration testing is also known as pen testing or ethical hacking and is an authorized series of
security-related, nonmalicious “attacks” on targets such as computing devices, applications, or an
organization’s physical resources and personnel.
2. The purpose of pen testing is to discover vulnerabilities in targets so that these vulnerabilities can be
eliminated or mitigated.
a. True
b. False
Answer: a
The purpose of pen testing is to discover vulnerabilities in targets so that the vulnerabilities can be
eliminated or mitigated before a threat actor with malicious intent exploits them to cause damage to
systems, data, and the organization that owns them.
1
, Fehler! Verwenden Sie die Registerkarte 'Start', um Title dem Text zuzuweisen, der hier angezeigt werden soll.: Wilson, PenTest+ Guide to Penetration Testing
2e 2027, 9798214410180;
Chapter 1: Introduction to Penetration Testing
3. Pen testing should be performed under which of the following circumstances? Choose all that apply.
a. A new computer system has been installed.
b. A new software system or an update to a software system has been installed.
c. Following a regular schedule to make sure no unknown changes have impacted security.
d. Performed as dictated by compliance standards such as PCI DSS.
Answer: a, b, c, d
Pen testing should be performed as a regular practice, to meet compliance standards, and after a
major change in a computing environment, such as the installation of a new computer system,
application, or update.
4. Which of the following are possible targets for penetration testing?
a. Web application
b. Computer
c. Staff
d. All of these are correct
Answer: d
Web applications and other software, computers and related systems, and staff or other personnel
can be targets for penetration testing.
5. The targets under test and the actions that a pen tester is allowed to perform need to be well-defined,
documented, and agreed upon by all parties before pen testing begins.
a. True
b. False
Answer: a
Because pen-testing activities are the same as illegal hacking activities, though with different goals,
the pen-testing targets and actions must be well-defined, documented, and agreed upon by all
parties before pen testing begins.
6. The CIA triad expresses how the cornerstones of confidentiality, integrity, and accessibility are linked
together to provide security for computer systems and their data.
a. True
b. False
Answer: a
In the CIA triad, confidentiality of information dictates that an object should only be accessible to
authorized entities. Integrity of information or systems ensures that an object has not been corrupted
or destroyed by unauthorized entities. Availability requires that objects and services must be
accessible to authorized entities when needed and should not be made unavailable by threat actors
or system failures.
7. Which of the following are needed to properly maintain the ethical hacking mindset?
a. Pen testers must be careful to conduct themselves ethically with professionalism and integrity.
b. Pen testers must not accidentally stray into the realm of the malicious hacker and cause damage
to systems or data.
c. Pen testers must do no harm and stay within the boundaries of what activities have been
specified and sanctioned in the penetration testing agreement documents.
2
** All Chapters included
** Review Questions
** Activities & Case Projects
,Table of Contents are given below
Chapter 1. Introduction to Penetration Testing
Chapter 2. Setting Up a Penetration-Testing Lab
Chapter 3. Engagement Management
Chapter 4. Reporting and Communication
Chapter 5. Reconnaissance and Enumeration
Chapter 6. Performing Vulnerability Scanning
Chapter 7. Exploitation Methods and Tools
Chapter 8. Network Attacks and Attack Vectors
Chapter 9. Wireless and Specialized Systems Attack Vectors and Attacks
Chapter 10. Application-Based Attack Vectors and Attacks
Chapter 11. Host Attack Vectors and Cloud Technologies Attacks
Chapter 12. Social Engineering and Physical Attacks
Chapter 13. Writing and Understanding Code
Chapter 14. The Final Penetration-Testing Project
,Fehler! Verwenden Sie die Registerkarte 'Start', um Title dem Text zuzuweisen, der hier angezeigt werden soll.: Wilson, PenTest+ Guide to Penetration Testing
2e 2027, 9798214410180;
Chapter 1: Introduction to Penetration Testing
Solution and Answer Guide
WILSON, COMPTIA PENTEST+ GUIDE TO PENETRATION TESTING 2e 2027, 9798214410180; CHAPTER 1:
INTRODUCTION TO PENETRATION TESTING
TABLE OF CONTENTS
Review Questions ..............................................................................................................................1
Activities ...........................................................................................................................................4
Activity 1-1: Determining the Corporate Need for Penetration Testers .................................................. 4
Activity 1-2: Examining the Top 25 Most Dangerous Programming Errors .............................................. 4
Activity 1-3: Identifying Computer Statutes in Your State, Province, or County ...................................... 4
Activity 1-4: Examining Federal and International Computer Crime Laws ............................................... 5
Case Projects .....................................................................................................................................5
Case Project 1-1: Determining Legal Requirements for Penetration Testing ........................................... 5
Case Project 1-2: Researching Hacktivists at Work................................................................................... 6
REVIEW QUESTIONS
1. What are two other terms for penetration testing?
a. Vulnerability testing
b. Pen testing
c. Ethical hacking
d. Blue teaming
Answer: b, c
Penetration testing is also known as pen testing or ethical hacking and is an authorized series of
security-related, nonmalicious “attacks” on targets such as computing devices, applications, or an
organization’s physical resources and personnel.
2. The purpose of pen testing is to discover vulnerabilities in targets so that these vulnerabilities can be
eliminated or mitigated.
a. True
b. False
Answer: a
The purpose of pen testing is to discover vulnerabilities in targets so that the vulnerabilities can be
eliminated or mitigated before a threat actor with malicious intent exploits them to cause damage to
systems, data, and the organization that owns them.
1
, Fehler! Verwenden Sie die Registerkarte 'Start', um Title dem Text zuzuweisen, der hier angezeigt werden soll.: Wilson, PenTest+ Guide to Penetration Testing
2e 2027, 9798214410180;
Chapter 1: Introduction to Penetration Testing
3. Pen testing should be performed under which of the following circumstances? Choose all that apply.
a. A new computer system has been installed.
b. A new software system or an update to a software system has been installed.
c. Following a regular schedule to make sure no unknown changes have impacted security.
d. Performed as dictated by compliance standards such as PCI DSS.
Answer: a, b, c, d
Pen testing should be performed as a regular practice, to meet compliance standards, and after a
major change in a computing environment, such as the installation of a new computer system,
application, or update.
4. Which of the following are possible targets for penetration testing?
a. Web application
b. Computer
c. Staff
d. All of these are correct
Answer: d
Web applications and other software, computers and related systems, and staff or other personnel
can be targets for penetration testing.
5. The targets under test and the actions that a pen tester is allowed to perform need to be well-defined,
documented, and agreed upon by all parties before pen testing begins.
a. True
b. False
Answer: a
Because pen-testing activities are the same as illegal hacking activities, though with different goals,
the pen-testing targets and actions must be well-defined, documented, and agreed upon by all
parties before pen testing begins.
6. The CIA triad expresses how the cornerstones of confidentiality, integrity, and accessibility are linked
together to provide security for computer systems and their data.
a. True
b. False
Answer: a
In the CIA triad, confidentiality of information dictates that an object should only be accessible to
authorized entities. Integrity of information or systems ensures that an object has not been corrupted
or destroyed by unauthorized entities. Availability requires that objects and services must be
accessible to authorized entities when needed and should not be made unavailable by threat actors
or system failures.
7. Which of the following are needed to properly maintain the ethical hacking mindset?
a. Pen testers must be careful to conduct themselves ethically with professionalism and integrity.
b. Pen testers must not accidentally stray into the realm of the malicious hacker and cause damage
to systems or data.
c. Pen testers must do no harm and stay within the boundaries of what activities have been
specified and sanctioned in the penetration testing agreement documents.
2
