Ethical Hacking Penetration Testing Syllabus

Penetration Testing syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Penetration Testing in Ethical Hacking, not a summary of it.

1. 1

   Penetration Testing Concepts

   3 topics

   • What is Penetration Testing?
   • Types of Penetration Testing
   • Penetration Testing Methodologies
2. 2

   Penetration Testing Phases

   6 topics

   • Planning and Preparation
   • Information Gathering
   • Vulnerability Analysis
   • Exploitation
   • Post-Exploitation
   • Reporting
3. 3

   Penetration Testing Tools

   4 topics

   • Metasploit
   • Burp Suite
   • Nessus
   • OWASP ZAP
4. 4

   Reporting and Documentation

   3 topics

   • Writing Penetration Test Reports
   • Documenting Findings
   • Providing Recommendations

Penetration Testing flashcards for Ethical Hacking

21 of 50 cards from the Penetration Testing deck — real questions with worked answers.

1. What is penetration testing?

   An authorized, simulated cyberattack on a system, network, or application performed to evaluate its security by safely identifying and exploiting vulnerabilities that a real attacker could abuse.

2. How does penetration testing differ from vulnerability scanning?

   Vulnerability scanning automatically detects and lists potential weaknesses; penetration testing goes further by actively exploiting those weaknesses to prove real-world impact and demonstrate exploitability.

3. What is the primary goal of a penetration test?

   To identify exploitable security weaknesses, demonstrate their business impact, and provide actionable recommendations to reduce risk before a malicious attacker can exploit them.

4. In penetration testing, what distinguishes black-box, white-box, and gray-box testing?

   Black-box: tester has no prior knowledge of the target. White-box: tester has full knowledge (source code, architecture, credentials). Gray-box: tester has partial knowledge, such as limited credentials or documentation.

5. What is external penetration testing?

   Testing that targets internet-facing assets (web servers, firewalls, VPNs, email) from outside the organization to assess what an external attacker with no internal access could achieve.

6. What is internal penetration testing?

   Testing performed from inside the network to simulate an insider threat or an attacker who has already breached the perimeter, assessing lateral movement and privilege escalation.

7. List common types of penetration testing by target.

   Network (external/internal), web application, wireless, social engineering, physical, mobile application, cloud, and API penetration testing.

8. What is the difference between a penetration test and a red team engagement?

   A pen test focuses on finding as many vulnerabilities as possible in a defined scope within a set time. A red team engagement is goal-oriented and stealthy, emulating a real adversary to test detection and response over a longer period.

9. Name three widely used penetration testing methodologies/standards.

   PTES (Penetration Testing Execution Standard), OSSTMM (Open Source Security Testing Methodology Manual), OWASP Testing Guide, and NIST SP 800-115.

10. What are the seven phases of the PTES methodology?

    1) Pre-engagement interactions, 2) Intelligence gathering, 3) Threat modeling, 4) Vulnerability analysis, 5) Exploitation, 6) Post-exploitation, 7) Reporting.

11. What does the OWASP Testing Guide primarily cover?

    A comprehensive framework for testing web application security, organized around categories such as authentication, session management, input validation, and business logic testing.

12. What is the purpose of the Rules of Engagement (RoE) in a penetration test?

    A formal document defining scope, permitted targets, testing methods, timing, escalation contacts, and constraints, ensuring the test is legal, authorized, and safe.

13. Why is a signed authorization/scope agreement essential before testing?

    Testing systems without written authorization is illegal (unauthorized access). The agreement provides legal protection, defines boundaries, and establishes a 'get-out-of-jail' authorization letter.

14. What key elements should be defined during planning and preparation?

    Scope, objectives, rules of engagement, target IP ranges/URLs, testing window, type (black/white/gray-box), points of contact, and legal authorization.

15. What is the difference between passive and active information gathering?

    Passive gathering collects data without directly interacting with the target (e.g., WHOIS, search engines, OSINT). Active gathering directly probes the target (e.g., port scanning, banner grabbing), which is more detectable.

16. What is OSINT in the context of reconnaissance?

    Open-Source Intelligence: the collection of publicly available information (social media, WHOIS, DNS records, job postings, breach data) to profile a target without direct interaction.

17. Which tool is commonly used for network port scanning and host discovery?

    Nmap (Network Mapper), used for host discovery, port scanning, service/version detection, and OS fingerprinting.

18. What Nmap scan type performs a stealthy half-open TCP scan, and how is it invoked?

    The TCP SYN scan (half-open scan), invoked with the -sS flag; it sends SYN packets and never completes the handshake, making it faster and stealthier.

19. What is vulnerability analysis in the pen testing process?

    The phase of identifying and validating security weaknesses in target systems, correlating discovered services and versions against known vulnerabilities to prioritize potential attack paths.

20. What does CVE stand for and what is its purpose?

    Common Vulnerabilities and Exposures: a standardized identifier (e.g., CVE-2021-44228) for publicly known security vulnerabilities, enabling consistent reference across tools and databases.

21. What does CVSS measure and what is its score range?

    The Common Vulnerability Scoring System measures the severity of a vulnerability on a scale from $0.0$ to $10.0$, where higher scores indicate greater severity.

See more Penetration Testing flashcards →

Planning Penetration Testing for Ethical Hacking

Penetration Testing (Ethical Hacking) FAQ