Penetration Testing Language | Security Lab Exercises

1 / 5

A security team brief states: "This is a black-box assessment — the testers have no prior knowledge of the system."

Which description correctly distinguishes black-box, white-box, and grey-box testing?

Black/white/grey box refers to how much prior knowledge and access testers have — not the network position or authentication state.

Assessment type	Tester knowledge	Pros	Cons
Black-box	Zero — simulates an external attacker with no insider knowledge	Realistic attacker simulation; tests external defences	Time-intensive; may miss internal vulnerabilities
White-box	Full — source code, architecture, credentials, design docs	Maximum coverage; finds logic flaws missed by automated tools	Expensive; doesn't test external-facing defences
Grey-box	Partial — user credentials, API docs, but not source code	Most common real-world engagement; good depth-to-cost ratio	May miss issues only visible with full source access

2 / 5

A pen test report states: "The tester pivoted from a compromised DMZ server to access the internal network segment containing the database servers."

What does "pivoting" mean in this context?

Pivoting = attacker uses a foothold (the compromised DMZ server) to reach systems that are unreachable directly from the external network.

Term	Meaning
Foothold	Initial access point — the first system compromised in an attack chain
Pivoting	Using the foothold to route attacks to otherwise unreachable internal systems
Lateral movement	Moving between systems at the same privilege level within a network segment
Tunnelling	Encapsulating one protocol inside another to bypass firewalls (e.g., SSH tunnelling, DNS tunnelling)
Privilege escalation	Moving from a lower-privilege account (e.g., www-data) to a higher-privilege one (e.g., root)

Why this matters: Pivoting is why network segmentation is a critical defence. If the DMZ server can directly reach database servers on the internal network, a single compromise unlocks the entire environment.

3 / 5

A pen test scope document states: "All testing must remain within the agreed boundaries — scanning or exploiting systems outside the listed IP ranges constitutes unauthorised access."

What is the term for these agreed limits?

Rules of Engagement (RoE) and scope of work define what testers can and cannot do — testing outside scope is legally unauthorised access.

RoE element	What it covers
In-scope targets	IP ranges, domains, application URLs, API endpoints that may be tested
Out-of-scope targets	Third-party services, production databases, shared hosting — explicitly excluded
Testing windows	Permitted hours (e.g., off-hours only to avoid disrupting production)
Emergency stop	Contact number to halt testing immediately if unintended impact is detected
Get-out-of-jail letter	Written authorisation the tester carries to show law enforcement if questioned

Key vocabulary: "scope of engagement", "out of scope", "authorisation to test", "rules of engagement", "get-out-of-jail letter".

4 / 5

After completing a pen test, the tester produces a report with sections for "Executive Summary", "Technical Findings", and "Remediation Guidance".

What should the Executive Summary contain?

The Executive Summary is written for C-suite / non-technical stakeholders — not engineers. It communicates business risk, not technical mechanics.

Report section	Audience	Key content
Executive Summary	CISO, CEO, board members	Overall risk rating, key findings in business terms, remediation priorities, business impact
Technical Findings	Security engineers, developers	Vulnerability details, CVSS scores, reproduction steps, screenshots or proof-of-concept
Remediation Guidance	Engineering teams	Specific fix recommendations prioritised by severity and effort

Executive Summary key elements: Overall risk posture (e.g., "the application has 3 Critical, 7 High findings"), the most significant finding and its business impact (e.g., "an unauthenticated attacker could access customer payment data"), and recommended immediate vs. medium-term remediation priorities.

5 / 5

A vulnerability scan finds a server running SSL 3.0. The pen tester marks it as the POODLE vulnerability (CVE-2014-3566) and recommends "attack surface reduction" as the remediation strategy.

What does attack surface reduction mean in this remediation context?

Attack surface reduction = actively remove, disable, or restrict anything not strictly needed. For POODLE: disable SSL 3.0 and enforce TLS 1.2+.

Remediation concept	Meaning	POODLE example
Remediation	Fix the root cause of the vulnerability	Disable SSL 3.0 entirely — root cause removed
Mitigation	Reduce impact without fixing the root cause (temporary control)	WAF rule to block SSL 3.0 requests — root cause still present
Attack surface reduction	Remove unnecessary features, protocols, services, and entry points	Disable SSL 3.0, SSLv2, TLS 1.0, TLS 1.1 — enforce TLS 1.2+ minimum

Key vocabulary:

Legacy protocol deprecation — formally removing support for old, insecure protocol versions
Cipher suite hardening — configuring the server to only accept strong cipher suites
Protocol downgrade attack — POODLE exploits a fallback mechanism where the server agrees to use SSL 3.0 even if TLS is supported
TLS configuration — the set of protocol versions and cipher suites a server will accept