What is the purpose of the post-exploitation phase in penetration testing?

Question

Options

• ATo test firewall rulesTo ensure that all logs are deleted
• BTo ensure that all logs are deleted
• CTo determine the value of the data obtained during exploitation
• DTo perform vulnerability scanning

• A
  4% (1)
• C
  91% (21)
• D
  4% (1)

Explanation

Post-exploitation is the phase after an attacker (or pen tester) has successfully compromised a system - its purpose is to assess the impact of that compromise by determining what sensitive data is accessible, how valuable it is, and what further systems can be reached. This directly maps to C, because the core question being answered is: "Given we got in, what did we actually gain, and what is its worth to the organization?"

Why the distractors are wrong:

• A (test firewall rules) - Firewall testing belongs to the reconnaissance or scanning phases, before exploitation occurs.
• B (delete all logs) - Log deletion is an anti-forensics technique associated with covering tracks, which is a separate concern and not the purpose of post-exploitation in legitimate pen testing.
• D (vulnerability scanning) - Scanning happens during the enumeration/scanning phase, well before any exploitation takes place.

Memory tip: Think of post-exploitation as the "so what?" phase - you're in the system, now answer so what can I do, so what can I access, so what is it worth? The word "post" = after the break-in, focus shifts to value and impact assessment.

No community discussion yet for this question.