iSACA Cybersecurity Fundamentals Certification Practice Exam

Which phase of penetration testing involves attempting to exploit identified vulnerabilities?

1. Discovery

2. Planning

3. Attack

4. Reporting

The correct answer is: Attack

In penetration testing, the phase that involves attempting to exploit identified vulnerabilities is the Attack phase. This stage is critical because it is where the penetration tester actively engages with the target system to gain unauthorized access or escalate privileges, thereby mimicking malicious activities. The focus here is on verifying the existence of vulnerabilities that were discovered earlier and assessing the potential impact of these vulnerabilities in a real-world scenario. During the Attack phase, the tester uses the information gathered from prior phases, like Discovery, to craft specific attacks tailored to the vulnerabilities identified. Successful exploitation during this phase helps in understanding the effectiveness of the existing security controls and determining the actual risk associated with the vulnerabilities. In contrast, the Discovery phase is about gathering intelligence and identifying potential vulnerabilities without actively exploiting them. The Planning phase involves outlining the scope and rules of engagement for the penetration test to ensure that it is conducted safely and effectively, while the Reporting phase focuses on documenting the findings and providing recommendations based on the outcomes of the testing. Each phase has a distinct purpose, but the Attack phase is uniquely characterized by the active attempt to exploit vulnerabilities.