eJPT eJPT Exam Fundamentals and Penetration Testing Methodology 1 — Questions and Answers
Question 1: What is the correct order of phases in a standard penetration testing methodology?
- Exploitation → Reconnaissance → Reporting → Scanning
- Reconnaissance → Scanning → Exploitation → Post-Exploitation → Reporting (Correct answer)
- Reporting → Scanning → Exploitation → Reconnaissance
- Exploitation → Scanning → Reconnaissance → Reporting
Correct answer: Reconnaissance → Scanning → Exploitation → Post-Exploitation → Reporting
The standard pentest flow is Reconnaissance → Scanning → Exploitation → Post-Exploitation → Reporting to ensure structured, thorough testing.
Question 2: What is the eJPT certification primarily designed to validate?
- Advanced exploit development skills
- Junior-level practical penetration testing skills (Correct answer)
- Malware reverse engineering ability
- Cloud security architecture knowledge
Correct answer: Junior-level practical penetration testing skills
The eJPT (eLearnSecurity Junior Penetration Tester) validates foundational, practical hands-on penetration testing skills at the junior level.
Question 3: What type of engagement is a penetration test where the tester has full knowledge of the target environment, including source code and architecture?
- Black-box testing
- Gray-box testing
- White-box testing (Correct answer)
- Red-team engagement
Correct answer: White-box testing
White-box testing provides the tester with full knowledge of the system, including network diagrams, credentials, and source code.
Question 4: Which document formally authorizes a penetration tester to conduct testing against a client's systems?
- Non-Disclosure Agreement (NDA)
- Rules of Engagement (RoE) / Scope of Work (Correct answer)
- Bug Bounty Terms
- Incident Response Plan
Correct answer: Rules of Engagement (RoE) / Scope of Work
The Rules of Engagement or Scope of Work document defines authorized targets, methods, and timing, legally permitting the pentest.
Question 5: In a black-box penetration test, what information is provided to the tester at the start?
- Full network diagrams and credentials
- Source code of all applications
- Only the target IP range or domain (Correct answer)
- All vulnerability scan results
Correct answer: Only the target IP range or domain
In black-box testing, the tester receives minimal information (typically just the target scope) to simulate an external attacker.
Question 6: What is the main goal of a penetration test compared to a vulnerability assessment?
- List vulnerabilities without exploitation
- Actively exploit vulnerabilities to demonstrate real-world impact (Correct answer)
- Only review policies and procedures
- Install security patches on systems
Correct answer: Actively exploit vulnerabilities to demonstrate real-world impact
A penetration test goes beyond listing vulnerabilities by actively exploiting them to demonstrate actual risk and business impact.
eJPT eJPT Exam Fundamentals and Penetration Testing Methodology 1
What is the correct order of phases in a standard penetration testing methodology?