- | P a g e
WGU D484 OA EXAM / WGU D484
PENETRATION TESTING OBJECTIVE
ASSESSMENT NEWEST 2025 ACTUAL EXAM
COMPLETE 100 QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS)
|ALREADY GRADED A+ (BRAND NEW
VERSION!)
Set 1 (Questions 1–31) A penetration tester is currently reviewing the adherence to organizational policies and procedures. Which controls help to monitor this?the correct answer is Administrative - Administrative controls are security measures implemented to monitor the adherence to organizational policies and procedures. These include activities such as hiring and termination policies, employee training.A penetration tester is conducting a physical test on-premise and is attempting to exploit human errors. What type of risk is the pen tester trying to exploit?the correct answer is Social Engineering - Human errors can also be seen as Social Engineering, which attempts to leverage human mistakes to gain information used in attacks or breaches.A penetration tester is conducting a PCI DSS compliance report for a large company that does ten million transactions a year.What level should they comply with?the correct answer is Level 1 - Level 1 is a large merchant with over six million transactions a year and must have an external
- | P a g e
auditor perform the assessment by an approved Qualified Security Assessor (QSA).A penetration tester has joined a consulting company that performs tests for several varying clients. The company has stressed about staying within the scope of the project. What is the worst thing the tester could face if they go outside their scope?the correct answer is Criminal charges - Even though a PenTest is performed with the mutual consent of the customer, the team may inadvertently violate a local, state, or regional law. This could result in up to criminal charges.A student is studying penetration testing methodologies and is trying to narrow in their skill sets to web application testing.Which of the following should they focus on?the correct answer is OWASP - The Open Web Application Security Project (OWASP) is an organization aimed at increasing awareness of web security and provides a framework for testing during each phase of the software development process.A penetration tester wants to become more efficient and effective at penetration testing. What standard provides a comprehensive overview of the proper structure of a complete PenTest and includes discussion on several topics, such as pre- engagement interactions, threat modeling, vulnerability analysis, exploitation, and reporting?
- | P a g e
the correct answer is PTES - The Penetration Testing Execution Standard (PTES) has seven main sections that provide a comprehensive overview of the proper structure of a complete PenTest. Some of the sections include details on topics such as pre-engagement interactions, threat modeling, vulnerability analysis, exploitation, and reporting.A security professional is researching the latest vulnerabilities that have been released. Where is a good resource they can go to in order to look at these?the correct answer is NVD - To learn more about the vulnerabilities, you can often click on CVE names, which have hyperlinks to the record in the National Vulnerability Database (NVD). Once there, you can read more details.A new penetration tester is creating a summary of their first upcoming process and wants to follow the standard process.What step takes place after planning?the correct answer is Recon - Reconnaissance is next and focuses on gathering as much information about the target as possible. This process includes searching information on the Internet, using Open-Source Information Gathering Tools (OSINT), and websites.A penetration tester has been contracted to do a test for a hospital and is looking at computerized electronic patient records. What are these referred to as?the correct answer is e-PHI - Computerized electronic patient records are referred to as electronic protected health information
- | P a g e
(e-PHI). With HIPAA, the e-PHI of any patient must be protected from exposure, or the organization can face a hefty fine.A marketing coordinator meets with many high-profile companies to discuss penetration testing engagements. Which of the following is NOT something they might want to show to ensure confidence and trust in their team?the correct answer is Pre-Discovered information - Penetration testing companies should never do work before entering into an agreement including scope. This could possibly lead to prosecution.A company has contracted an independent penetration testing company to do API testing. Which of the following are they most likely testing?the correct answer is Cloud resources - API testing is common with cloud resources. Companies recognize the vulnerabilities that exist when dealing with cloud assets. Many have turned to penetration testers to test the strength of the security mechanisms.A security firm is looking at expanding operations outside the United States. Which of the following tools might be illegal to use due to U.S. encryption export regulations?the correct answer is Wireshark - Wireshark is a powerful open- source protocol analysis tool that can decrypt many of the protocols used to conceal data, such as IPsec, Kerberos, and