What penetration testing is

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a penetration test?

A An authorised, simulated attack to find vulnerabilities

B A real attack carried out to steal data

2. Who normally carries out a penetration test?

A A black-hat hacker

B A white-hat (ethical) hacker

3. What makes a penetration test different from a real cyber attack?

A It uses completely different tools

B It has the owner's permission

4. When is the best time to run a penetration test?

A Before real attackers find the weaknesses

B After all the data has been stolen

5. What should happen after a penetration test finds a vulnerability?

A The weakness is fixed to improve security

B The weakness is kept secret and left open

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1penetration test		AThe test is run without the owner's written permission. Without authorisation it is an illegal attack, not a penetration test.
2white-hat hacker		Bif permission == True: run_pen_test(system)
3A pen test finds weaknesses so they can be fixed, which improves security		CAn authorised, simulated attack on a system to find vulnerabilities before real attackers do
4A pen test is only ethical when the system owner gives permission first		Dfindings = pen_test(system) fix(findings)
5run_pen_test(bank_system) # no permission asked		EBlack-hat hackers are not ethical hackers. They attack systems without permission for personal gain or to cause harm. White-hat hackers are the ethical ones.
6black_hat = ethical_hacker		FA hacker who has permission to test a system and reports weaknesses so they can be fixed

Definitions

penetration test

Fill in the Blanks

Complete each line of code by filling in the missing parts.

penTest.authorised = ____

blackHat.authorised = _____

if vulnerabilityFound: ___(vulnerability)

found = runPenTest(system) ___ weakness in found: fix(weakness)

tester = ________() # ethical hacker

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A tester = "white-hat"

B authorised = True

C if authorised == False:

D print("Start pen test")

Question 2

A scope = ["web app", "login"]

B written_permission = True

C if written_permission:

D for t in everything:

E print("Test", t)

Question 3

A found = ["weak password"]

B report = []

C for v in found:

D report.add(v)

Question 4

A hacker = "white-hat"

B permission = True

C purpose = "steal data"

D print(hacker, purpose)

Question 5

A test_type = "simulated"

B real_damage = True

C print("No real harm done")

Answer Key

What penetration testing is

Section A: Quick Questions

A — An authorised, simulated attack to find vulnerabilities

B — A white-hat (ethical) hacker

B — It has the owner's permission

A — Before real attackers find the weaknesses

A — The weakness is fixed to improve security

Section B: Match the Pairs

penetration test → An authorised, simulated attack on a system to find vulnerabilities before real attackers do

white-hat hacker → A hacker who has permission to test a system and reports weaknesses so they can be fixed

A pen test finds weaknesses so they can be fixed, which improves security → findings = pen_test(system) fix(findings)

A pen test is only ethical when the system owner gives permission first → if permission == True: run_pen_test(system)

run_pen_test(bank_system) # no permission asked → The test is run without the owner's written permission. Without authorisation it is an illegal attack, not a penetration test.

black_hat = ethical_hacker → Black-hat hackers are not ethical hackers. They attack systems without permission for personal gain or to cause harm. White-hat hackers are the ethical ones.

Section C: Definitions

penetration test — An authorised, simulated attack on a system by an ethical (white-hat) hacker to find vulnerabilities before real attackers (black-hat) do, so the weaknesses can be fixed.

Section D: Fill in the Blanks

penTest.authorised = True

blackHat.authorised = False

if vulnerabilityFound:
    fix(vulnerability)

found = runPenTest(system)
for weakness in found:
    fix(weakness)

tester = WhiteHat() # ethical hacker

Section E: Spot the Error

C — A penetration test must only run when the tester has authorisation. The condition should be authorised == True, otherwise the test starts only when permission is missing.

D — A pen test must stay within the agreed scope. The loop should go through scope, not an undefined name such as everything.

D — Python lists use append() to add an item, not add(). Each vulnerability found must be added to the report so it can be fixed.

C — A white-hat hacker is authorised and tests a system to find weaknesses so they can be fixed. Stealing data is the aim of a black-hat attacker. It should be "fix weaknesses".

B — A penetration test is a simulated attack, so it must not cause real damage. real_damage should be False, which also matches the message printed on line 3.