← WA Computer Science ATAR Unit 2

What penetration testing is

An authorised, simulated attack on a system by an ethical (white-hat) hacker to find vulnerabilities before real attackers (black-hat) do, so the weaknesses can be fixed.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 140

Understanding What penetration testing is in WA Computer Science ATAR Unit 2

What it does: The test results (findings) are used to fix the vulnerabilities, which is how a pen test improves security. Authorisation is what separates a white-hat pen test from a black-hat attack, so the test only runs when permission is given. A penetration test imitates a real attack, but it is permitted by the system owner and its aim is to find weaknesses so they can be fixed. Permission is the key difference. Testers may use the same tools and techniques as attackers, but they are authorised to do so. The purpose is to find vulnerabilities early, before a real attacker can exploit them.

Common mistakes: A penetration test must only run when the tester has authorisation. The condition should be authorised == True, otherwise the test starts only when permission is missing. A pen test must stay within the agreed scope. The loop should go through scope, not an undefined name such as everything.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add What penetration testing is to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a penetration test?
An authorised, simulated attack to find vulnerabilitiesA real attack carried out to steal data
Matches
run_pen_test(bank_system) # no permission asked
↓
The test is run without the owner's written permission. Without authorisation it is an illegal attack, not a penetration test.
Applying
Meanings
Term
penetration test
Meaning
An authorised, simulated attack on a system by an ethical (white-hat) hacker to find vulnerabilities before real attackers (black-hat) do, so the weaknesses can be fixed.
Practice
IF permission = "written" THEN
Testing
Gaps
penTest.authorised =
Check Answer
Spots
2authorised = True
3if authorised == False:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Red Panda' badge — Forest Explorer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a penetration test?
A. An authorised, simulated attack to find vulnerabilities ✓
B. A real attack carried out to steal data
A penetration test imitates a real attack, but it is permitted by the system owner and its aim is to find weaknesses so they can be fixed.
2. Who normally carries out a penetration test?
A. A black-hat hacker
B. A white-hat (ethical) hacker ✓
White-hat hackers use hacking skills legally and with permission to improve security. Black-hat hackers break in for personal gain or to cause harm.
3. What makes a penetration test different from a real cyber attack?
A. It uses completely different tools
B. It has the owner's permission ✓
Permission is the key difference. Testers may use the same tools and techniques as attackers, but they are authorised to do so.
4. When is the best time to run a penetration test?
A. Before real attackers find the weaknesses ✓
B. After all the data has been stolen
The purpose is to find vulnerabilities early, before a real attacker can exploit them.
5. What should happen after a penetration test finds a vulnerability?
A. The weakness is fixed to improve security ✓
B. The weakness is kept secret and left open
The findings are used to patch or fix the weaknesses, which makes the system more secure.

Match the Pairs

penetration test → An authorised, simulated attack on a system to find vulnerabilities before real attackers do
white-hat hacker → A hacker who has permission to test a system and reports weaknesses so they can be fixed
A pen test finds weaknesses so they can be fixed, which improves security → findings = pen_test(system) fix(findings)
A pen test is only ethical when the system owner gives permission first → if permission == True: run_pen_test(system)
run_pen_test(bank_system) # no permission asked → The test is run without the owner's written permission. Without authorisation it is an illegal attack, not a penetration test.
black_hat = ethical_hacker → Black-hat hackers are not ethical hackers. They attack systems without permission for personal gain or to cause harm. White-hat hackers are the ethical ones.

Key Term

penetration test
An authorised, simulated attack on a system by an ethical (white-hat) hacker to find vulnerabilities before real attackers (black-hat) do, so the weaknesses can be fixed.

Fill in the Blanks

1. penTest.authorised = True
Hint: Type the Boolean value that shows a penetration test has the system owner's permission.
2. blackHat.authorised = False
Hint: Type the Boolean value that shows a malicious attacker has no permission.
3. if vulnerabilityFound: fix(vulnerability)
Hint: Type the function name that repairs the weakness the test found, so security improves.
4. found = runPenTest(system) for weakness in found: fix(weakness)
Hint: Type the keyword that starts a loop over each vulnerability the test found.
5. tester = WhiteHat() # ethical hacker
Hint: Type the class name for the ethical hacker who tests a system with permission.

Spot the Error

Question 1
A tester = "white-hat"
B authorised = True
C if authorised == False:
D print("Start pen test")
Line C — A penetration test must only run when the tester has authorisation. The condition should be authorised == True, otherwise the test starts only when permission is missing.
Question 2
A scope = ["web app", "login"]
B written_permission = True
C if written_permission:
D for t in everything:
E print("Test", t)
Line D — A pen test must stay within the agreed scope. The loop should go through scope, not an undefined name such as everything.
Question 3
A found = ["weak password"]
B report = []
C for v in found:
D report.add(v)
Line D — Python lists use append() to add an item, not add(). Each vulnerability found must be added to the report so it can be fixed.
Question 4
A hacker = "white-hat"
B permission = True
C purpose = "steal data"
D print(hacker, purpose)
Line C — A white-hat hacker is authorised and tests a system to find weaknesses so they can be fixed. Stealing data is the aim of a black-hat attacker. It should be "fix weaknesses".
Question 5
A test_type = "simulated"
B real_damage = True
C print("No real harm done")
Line B — A penetration test is a simulated attack, so it must not cause real damage. real_damage should be False, which also matches the message printed on line 3.

Student with a class code? Join your class →