Practice English vocabulary for network penetration testing: recon, port scanning, lateral movement, data exfiltration findings, and network segmentation.
0 / 10 completed
1 / 10
During the initial phase, the pentester mapped the target's exposed services and found 3 open ports. Which phrase is correct?
The 'recon phase' (reconnaissance) is the information-gathering stage of a penetration test. Discovering open ports during recon is the expected outcome before moving to exploitation.
2 / 10
The pentester ran a network scan and found a management interface accessible from the internet with no authentication. Which phrase is correct?
'The network scan revealed an exposed admin panel' means the scanning tool discovered an administrative interface that is accessible externally — a critical finding in a pentest report.
3 / 10
After gaining access to one internal system, the attacker used it as a foothold to reach other internal systems. What is this technique called?
'Lateral movement' is the technique of moving from one compromised system to other systems within the same network. It is a key phase in the attack kill chain after initial access.
4 / 10
After thorough investigation, the pentesters confirmed that no sensitive data was copied or transferred out of the network. Which phrase is correct?
'Data exfiltration' means unauthorized transfer of data out of the target environment. 'We found no evidence of data exfiltration' is the standard phrase in pentest reports to indicate this attack vector was not observed.
5 / 10
The network is divided into isolated segments so that an attacker who compromises one segment cannot easily reach others. Which phrase describes this security control?
'Network segmentation limits blast radius' means that dividing the network into isolated zones restricts how far an attacker can spread after initial compromise. 'Blast radius' is the standard term for the scope of potential damage.
6 / 10
During a vulnerability assessment of the web application, Sarah noticed that the server logs were excessively verbose. She suspected potential log injection attacks. Which phrase best describes her immediate concern?
Log injection attacks exploit vulnerabilities in how applications handle log data. Sarah's concern accurately identifies this risk – an attacker could be crafting malicious log entries to bypass security controls or execute commands. Option A describes resource utilization, option C is dismissive, and option D focuses on performance, not the core attack vector.
7 / 10
Mark, a penetration tester, was using Nmap to identify open ports on a target server. He discovered a service running on port 8080 that responded with a cryptic error message: 'Connection refused.' Which of the following best explains Mark's next step?
Initial reconnaissance often reveals services that aren't properly configured or are running outdated versions. Mark should confirm whether the service is actually listening on port 8080 before assuming a problem. Directly attempting to connect (option 2) provides crucial information – if it's refused, the service isn't available, and blocking is premature. Options 3 & 4 represent reactive or overly cautious actions.
8 / 10
During a post-exploitation phase, David successfully exploited a vulnerability in a web server and gained shell access. He needs to maintain persistence on the system so that he can return later. Which of the following techniques would be most appropriate for David?
Persistence mechanisms are essential for attackers who need repeated access. A reverse shell (option 2) allows David to maintain a connection back to his control machine. The other options represent cleanup or defensive actions – they don't help David regain access later. Deleting files (option 1) is standard cleanup but doesn't achieve persistence.
9 / 10
Elena, a security consultant, was reviewing the documentation for a new web application. She found several references to 'API Keys' and 'OAuth 2.0'. Which of the following best describes their role in securing the application?
OAuth 2.0 is a delegated authorization framework. It enables third-party applications to access protected resources on behalf of a user without needing their username and password. API keys are used for authentication but aren't sufficient for secure authorization – OAuth 2.0 provides a far more robust solution, controlling *what* the application can access. Options 3 & 4 misrepresent the function of these technologies.
10 / 10
During a penetration test of a cloud infrastructure, Liam discovered that an S3 bucket was publicly accessible. The bucket contained sensitive configuration files. What is the primary concern regarding this vulnerability?
Data exposure is a critical concern in cloud environments. Publicly accessible S3 buckets often contain sensitive data that can be accessed and potentially stolen by unauthorized individuals. While the other options represent potential problems, they are secondary concerns compared to the direct risk of data leakage. The core issue is the lack of access control.
What will I practise in "Network Penetration Testing Vocabulary"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.