CAP · Question #402
Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following…
The correct answer is A. Social engineering B. File and directory permissions C. Buffer overflows D. Kernel flaws E. Race conditions G. Trojan horses. Penetration testing covers exploitation of human, software, and system-level vulnerabilities, but information system architectures are a design artifact analyzed in threat modeling rather than a directly exploitable target.
Question
Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.
Options
- ASocial engineering
- BFile and directory permissions
- CBuffer overflows
- DKernel flaws
- ERace conditions
- FInformation system architectures
- GTrojan horses
How the community answered
(52 responses)- A90% (47)
- F10% (5)
Why each option
Penetration testing covers exploitation of human, software, and system-level vulnerabilities, but information system architectures are a design artifact analyzed in threat modeling rather than a directly exploitable target.
Information system architectures represent the structural design of systems and are used during threat modeling and risk assessments, not as a directly exploitable attack surface during a penetration test.
Concept tested: Penetration testing scope and exploitable attack vectors
Source: https://owasp.org/www-project-web-security-testing-guide/
Topics
Community Discussion
No community discussion yet for this question.