WGU D332|1
WGU D332 — PENETRATION TESTING AND
VULNERABILITY ANALYSIS | STUDY GUIDE |
LATEST UPDATE 2026/2027 | PRACTICE QUESTIONS
AND ANSWERS | EXAM REVIEW
Table of Contents
1. Planning and Scoping
2. Information Gathering and Vulnerability Scanning
3. Attacks and Exploits
4. Reporting and Communication
5. Tools and Code Analysis
, WGU D332|2
Question 1: A penetration tester is engaged for a gray box assessment of a healthcare
organization's external web application. Which document MUST be signed and in place
BEFORE any scanning activities begin?
A) Vulnerability scan report template
B) Master service agreement (MSA) with statement of work (SOW)
C) Post-exploitation cleanup checklist
D) Threat modeling diagram (STRIDE)
Correct Answer: B) Master service agreement (MSA) with statement of work (SOW)
The MSA and SOW define the legal scope, authorization, rules of engagement, and liability
for the penetration test. Written authorization is required before any testing to avoid legal
violations under the Computer Fraud and Abuse Act (CFAA).
Question 2: During the planning phase, a tester identifies that the target organization
processes credit card transactions. Which compliance framework would be MOST relevant to
the scope and reporting requirements?
A) HIPAA
B) PCI DSS
C) SOX
D) GDPR
Correct Answer: B) PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) specifically governs the
handling of credit card data. HIPAA is for healthcare (PHI), SOX is for financial reporting,
and GDPR is for EU data privacy.
Question 3: A penetration tester is using the STRIDE methodology to model threats against a
new web application. If an attacker exploits a vulnerability to access user data without
authorization, which element of STRIDE does this represent?
A) Spoofing
B) Tampering
C) Information disclosure
D) Denial of service
Correct Answer: C) Information disclosure
, WGU D332|3
Information disclosure refers to the exposure of information to unauthorized individuals.
Spoofing is identity impersonation, tampering is unauthorized data modification, and denial
of service is availability disruption.
Question 4: Which of the following scenarios describes a "Black Box" penetration test?
A) The tester is provided with network diagrams and credentials
B) The tester has no prior knowledge of the target other than the name
C) The tester focuses on social engineering and physical security only
D) The tester uses automated tools exclusively without manual intervention
Correct Answer: B) The tester has no prior knowledge of the target other than the name
A Black Box test simulates an external hacker with no internal knowledge (zero-knowledge).
Option A describes a White Box test, Option C describes a specific type of engagement, and
Option D describes a tooling methodology.
Question 5: A client specifies in the Rules of Engagement (ROE) that no Denial of Service
(DoS) testing is permitted. Which of the following actions would violate the ROE?
A) Running a SYN scan on the external firewall
B) Attempting to exploit a buffer overflow in a web server
C) Sending a flood of UDP packets to test bandwidth capacity
D) Performing a brute-force attack on the FTP login portal
Correct Answer: C) Sending a flood of UDP packets to test bandwidth capacity
Sending a flood of packets constitutes a DoS attack or stress test, which was explicitly
prohibited. SYN scans, exploit attempts, and brute-force attacks are generally acceptable
unless they specifically cause a service crash or outage.
Question 6: When calculating risk using the formula Risk = Likelihood × Impact, which of
the following represents a "Qualitative" risk assessment?
A) Likelihood: 0.7, Impact: $50,000
B) Likelihood: High, Impact: Critical
C) Likelihood: 75%, Impact: $100,000
D) Likelihood: 3, Impact: 5
Correct Answer: B) Likelihood: High, Impact: Critical
, WGU D332|4
Qualitative risk assessments use descriptive categories such as "High," "Medium," and
"Low" rather than numerical values. Quantitative assessments use numerical values for
likelihood and impact.
Question 7: A penetration tester is reviewing a client's regulatory obligations. The client is a
financial institution that handles personal financial information. Which U.S. law primarily
protects the privacy of this data?
A) HIPAA
B) GLBA
C) FERPA
D) COPPA
Correct Answer: B) GLBA
The Gramm-Leach-Bliley Act (GLBA) protects the privacy of individuals' financial
information held by financial institutions. HIPAA covers healthcare, FERPA covers education
records, and COPPA covers children's online privacy.
Question 8: Which of the following is the PRIMARY purpose of a statement of work (SOW)
in a penetration testing engagement?
A) To define the technical tools to be used during testing
B) To outline the scope, deliverables, timeline, and cost of the engagement
C) To provide legal authorization for testing activities
D) To document the findings after testing is complete
Correct Answer: B) To outline the scope, deliverables, timeline, and cost of the
engagement
The SOW defines the specific work to be performed, including scope, deliverables, timeline,
and cost. While related to the MSA, the SOW is more detailed about the actual engagement
parameters.
Question 9: A penetration tester discovers that a client's web application is vulnerable to SQL
injection. Which of the following is the MOST appropriate immediate action?
A) Exploit the vulnerability to extract all database contents
B) Document the finding and notify the client according to the communication plan
WGU D332 — PENETRATION TESTING AND
VULNERABILITY ANALYSIS | STUDY GUIDE |
LATEST UPDATE 2026/2027 | PRACTICE QUESTIONS
AND ANSWERS | EXAM REVIEW
Table of Contents
1. Planning and Scoping
2. Information Gathering and Vulnerability Scanning
3. Attacks and Exploits
4. Reporting and Communication
5. Tools and Code Analysis
, WGU D332|2
Question 1: A penetration tester is engaged for a gray box assessment of a healthcare
organization's external web application. Which document MUST be signed and in place
BEFORE any scanning activities begin?
A) Vulnerability scan report template
B) Master service agreement (MSA) with statement of work (SOW)
C) Post-exploitation cleanup checklist
D) Threat modeling diagram (STRIDE)
Correct Answer: B) Master service agreement (MSA) with statement of work (SOW)
The MSA and SOW define the legal scope, authorization, rules of engagement, and liability
for the penetration test. Written authorization is required before any testing to avoid legal
violations under the Computer Fraud and Abuse Act (CFAA).
Question 2: During the planning phase, a tester identifies that the target organization
processes credit card transactions. Which compliance framework would be MOST relevant to
the scope and reporting requirements?
A) HIPAA
B) PCI DSS
C) SOX
D) GDPR
Correct Answer: B) PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) specifically governs the
handling of credit card data. HIPAA is for healthcare (PHI), SOX is for financial reporting,
and GDPR is for EU data privacy.
Question 3: A penetration tester is using the STRIDE methodology to model threats against a
new web application. If an attacker exploits a vulnerability to access user data without
authorization, which element of STRIDE does this represent?
A) Spoofing
B) Tampering
C) Information disclosure
D) Denial of service
Correct Answer: C) Information disclosure
, WGU D332|3
Information disclosure refers to the exposure of information to unauthorized individuals.
Spoofing is identity impersonation, tampering is unauthorized data modification, and denial
of service is availability disruption.
Question 4: Which of the following scenarios describes a "Black Box" penetration test?
A) The tester is provided with network diagrams and credentials
B) The tester has no prior knowledge of the target other than the name
C) The tester focuses on social engineering and physical security only
D) The tester uses automated tools exclusively without manual intervention
Correct Answer: B) The tester has no prior knowledge of the target other than the name
A Black Box test simulates an external hacker with no internal knowledge (zero-knowledge).
Option A describes a White Box test, Option C describes a specific type of engagement, and
Option D describes a tooling methodology.
Question 5: A client specifies in the Rules of Engagement (ROE) that no Denial of Service
(DoS) testing is permitted. Which of the following actions would violate the ROE?
A) Running a SYN scan on the external firewall
B) Attempting to exploit a buffer overflow in a web server
C) Sending a flood of UDP packets to test bandwidth capacity
D) Performing a brute-force attack on the FTP login portal
Correct Answer: C) Sending a flood of UDP packets to test bandwidth capacity
Sending a flood of packets constitutes a DoS attack or stress test, which was explicitly
prohibited. SYN scans, exploit attempts, and brute-force attacks are generally acceptable
unless they specifically cause a service crash or outage.
Question 6: When calculating risk using the formula Risk = Likelihood × Impact, which of
the following represents a "Qualitative" risk assessment?
A) Likelihood: 0.7, Impact: $50,000
B) Likelihood: High, Impact: Critical
C) Likelihood: 75%, Impact: $100,000
D) Likelihood: 3, Impact: 5
Correct Answer: B) Likelihood: High, Impact: Critical
, WGU D332|4
Qualitative risk assessments use descriptive categories such as "High," "Medium," and
"Low" rather than numerical values. Quantitative assessments use numerical values for
likelihood and impact.
Question 7: A penetration tester is reviewing a client's regulatory obligations. The client is a
financial institution that handles personal financial information. Which U.S. law primarily
protects the privacy of this data?
A) HIPAA
B) GLBA
C) FERPA
D) COPPA
Correct Answer: B) GLBA
The Gramm-Leach-Bliley Act (GLBA) protects the privacy of individuals' financial
information held by financial institutions. HIPAA covers healthcare, FERPA covers education
records, and COPPA covers children's online privacy.
Question 8: Which of the following is the PRIMARY purpose of a statement of work (SOW)
in a penetration testing engagement?
A) To define the technical tools to be used during testing
B) To outline the scope, deliverables, timeline, and cost of the engagement
C) To provide legal authorization for testing activities
D) To document the findings after testing is complete
Correct Answer: B) To outline the scope, deliverables, timeline, and cost of the
engagement
The SOW defines the specific work to be performed, including scope, deliverables, timeline,
and cost. While related to the MSA, the SOW is more detailed about the actual engagement
parameters.
Question 9: A penetration tester discovers that a client's web application is vulnerable to SQL
injection. Which of the following is the MOST appropriate immediate action?
A) Exploit the vulnerability to extract all database contents
B) Document the finding and notify the client according to the communication plan
