What is Penetration testing?

An assessment in which, with the organization's permission, specialists try to break into the target systems using methods similar to those of real attackers, chaining vulnerabilities to see how far they can get. Unlike vulnerability scanning, which uses tools to find known vulnerabilities broadly, it checks whether vulnerabilities can actually be exploited and what the impact would be. An exercise that sets an objective and imitates attacker techniques to evaluate even the organization's ability to detect and respond is called a red team exercise.

Japanese name: ペネトレーションテスト

Penetration testing appears in 1 practice question across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Penetration testing

Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?

AAll three are different names for the same method, meaning using tools to find known vulnerabilities automatically and produce a list in a report
BScanning finds known vulnerabilities broadly and automatically, penetration testing actually attempts intrusion, and red team exercises evaluate even the ability to detect and respond
CA red team exercise is just the work of finding known vulnerabilities automatically with tools, and it is narrower in both scope and purpose than penetration testing

Show answer and explanation

Answer: B. Scanning finds known vulnerabilities broadly and automatically, penetration testing actually attempts intrusion, and red team exercises evaluate even the ability to detect and respond

Vulnerability scanning uses tools to examine many devices and pieces of software and broadly find known vulnerabilities and configuration flaws, and it is repeated regularly. Penetration testing checks, for targets within an agreed scope, whether specialists can actually break in by chaining vulnerabilities and how far they can get. A red team exercise sets an objective such as "exfiltrate customer data", imitates the methods of real attackers (such as ATT&CK techniques) and evaluates even whether the defending side (the blue team) notices and responds. All of them are carried out with the organization's prior permission on the scope and methods.

Penetration testing in the explanations

Penetration testing checks, for targets within an agreed scope, whether specialists can actually break in by chaining vulnerabilities and how far they can get.
Which of the following correctly describes the differences …

Questions that mention Penetration testing (1)

Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?

Books on Cyber Attacks and Defense in Practice Ad

Search Amazon for semiconductor Cyber Attacks and Defense in Practice

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary