When planning a penetration test, the tester will be MOST interested in which information?

When planning a penetration test, the tester will be most interested in the exploits that can attack the weaknesses of the target system or network. Exploits are the techniques or tools that take advantage of the vulnerabilities to compromise the security or functionality of the system or network. The tester will use the exploits to simulate a real attack and test the effectiveness of the security controls and defenses.

A. Places to install back doors is not the information that the tester will be most interested in when planning a penetration test, but rather the possible outcome or objective of the test. Back doors are the hidden or unauthorized access points that allow the attacker to bypass the security mechanisms and gain persistent access to the system or network.

B. The main network access points is not the information that the tester will be most interested in when planning a penetration test, but rather the preliminary information that the tester will need to obtain during the reconnaissance phase of the test. The main network access points are the devices or interfaces that connect the network to other networks or the internet, such as routers, switches, firewalls, or gateways.

C. Job application handouts and tours is not the information that the tester will be most interested in when planning a penetration test, but rather the potential source of information that the tester could use for social engineering or physical penetration. Job application handouts and tours are the materials or activities that the organization provides to the prospective employees or visitors, which could reveal some details about the organization’s structure, culture, or operations.

References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7, page 424; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 7, page 378