CISSP practice question 7 of 35

When planning a penetration test, the tester will be MOST interested in which information?

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Security Assessment and Testing

When planning a penetration test, the tester will be MOST interested in which information?

Answer options

Correct Answer:

D

Explanation

The fundamental purpose of a penetration test is to identify vulnerabilities and demonstrate their potential impact by actively exploiting them. During the planning phase, the tester's primary interest is to understand the target environment's potential weaknesses and map them to known or custom exploits. This information is crucial for defining the scope, methodology, and rules of engagement for the test. The entire attack strategy is built around the exploits that can be leveraged against the identified or suspected vulnerabilities.

References

1. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment: Section 6.4

"Vulnerability Validation

" states

"The primary objective of vulnerability validation is to obtain evidence to confirm that the vulnerability exists... This is often accomplished by trying to exercise or exploit the vulnerability." The planning phase (Section 5) is conducted with this end goal in mind.

2. (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

9th Edition: Chapter 20

"Security Assessment and Testing

" describes the phases of a penetration test. It states

"The goal of a penetration test is to simulate an attack to identify and exploit vulnerabilities." This confirms that the focus on exploits is central to the entire process

beginning with planning.

3. Penetration Testing: A Hands-On Introduction to Hacking (University of Georgia

CSCI 4260/6260 course material): The methodology taught

mirroring industry standards like the Penetration Testing Execution Standard (PTES)

emphasizes that after information gathering

the next logical step is vulnerability analysis and planning the exploitation phase. The plan revolves around "what can we exploit and how?" (See PTES Standard

"Vulnerability Analysis" and "Exploitation" phases).

Question 7 of 35

Question breakdown

Tests: Plan and conduct penetration testing
Difficulty: Medium

Key idea: A penetration test is built around finding weaknesses and the exploits that can demonstrate them.

How to reach the answer

The clue is 'planning a penetration test' combined with 'MOST interested'.
A pen test differs from a vulnerability scan because it attempts exploitation to prove impact.
The tester therefore plans around which exploits can be used against expected weaknesses.
Access points and social engineering details are inputs, but they serve the exploitation goal.

Each option

AIncorrect. Installing back doors is generally out of scope for an authorized test and is not the central planning concern.
BIncorrect. Network access points are useful reconnaissance data but only as a means to apply exploits.
CIncorrect. Job handouts and tours can support social engineering, but they are minor information sources.
DCorrect. Exploits that can attack weaknesses are the core of the test plan, since the test aims to demonstrate exploitable vulnerabilities.

Common trap: Picking network access points because reconnaissance comes first, while missing that the question asks what matters most.

In practice: Pen test scoping and rules of engagement describe which classes of exploits are permitted against which targets, based on the expected attack surface.

Remember: Pen testing is about proving exploitability, so exploits against weaknesses drive the plan.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free CISSP practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other CISSP practice questions