Start Here
Six review stations, each a different way to practice Chapter 1. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or lab.
What this chapter asked you to be able to do
- Define penetration testing and tell it apart from vulnerability assessment, red teaming, bug bounty, and audit.
- Name the five phases of the penetration testing lifecycle and the goal of each.
- Classify a test by methodology (black, white, gray box) and by target domain (network, web, cloud, mobile, API, wireless, application).
- Explain the legal and ethical boundary that separates authorized testing from criminal hacking.
- Identify the roles in an engagement and what each is responsible for.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Placing Work in the Lifecycle
A professional test moves through five phases. Read each engagement, then label which phase each described action belongs to. The actions are shown in a shuffled order, not the order they happen.
Classifying by Methodology and Target Domain
Every engagement has one methodology (how much you are told at the start) and one target domain (what you are testing). The two are independent. For each scenario, choose both, then check.
Reference: methodology comparison
| Methodology | Information provided | Realism | Cost / timeline | Best for |
|---|---|---|---|---|
| Black box | Domain or IP range only | Highest | High / longest | External perimeter testing |
| White box | Full docs, source, credentials | Lowest | Low / shortest | Comprehensive coverage, code review |
| Gray box | Partial info or a foothold | Medium | Medium / medium | Lateral movement, insider threat |
Target domains include network, web application, cloud, mobile, API, wireless, and application security. Most real engagements are blended: a network test that also covers a web app and its API.
Which Security Practice Is This?
Clients often say “pen test” when they mean something else. Read each description and pick which practice it actually describes.
Authorization, Roles, and Ethics
Three short matching sets: what belongs in an authorization document, who does what on an engagement, and which ethical principle a situation illustrates. Choose a match for each item, then check.
A. Parts of an authorization document
Match each item to the section of the authorization it defines: Scope, Timeline, Test types, Excluded systems, or Escalation procedures.
B. Roles and responsibilities
Match each duty to the role that owns it: Penetration Tester, Authorized Contact, Incident Response Team, or System/Network Owner.
C. Ethical principles
Match each situation to the principle it illustrates: Written authorization, Scope limitation, Competence, Confidentiality, or Mandatory reporting.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.