3.6.3b Penetration Testing — AQA 8525

What is Penetration Testing?

Penetration testing (pen testing) is an authorised, simulated cyber attack performed by security professionals to identify vulnerabilities in a system before real attackers find them. The key distinction from criminal hacking is written permission and agreed scope — pen testers are hired by organisations to find weaknesses, not exploit them maliciously.

The goal is to produce a detailed report listing vulnerabilities found, their severity, and recommended fixes — so the organisation can strengthen its defences.

Types of Penetration Test

🤍

White Box

Tester has full knowledge of the system — architecture, source code, credentials. Most thorough. Simulates an insider threat or post-breach attacker.

🖤

Black Box

Tester has no prior knowledge — simulates an external attacker. Realistic but may miss issues that only appear with internal knowledge. Time-consuming.

🩶

Grey Box

Tester has partial knowledge (e.g. user-level credentials). Simulates an attacker who has already gained some internal access. Most common in practice.

Stages of a Penetration Test

Reconnaissance

Gather intelligence about the target — open ports, services, technologies, employee info

Scanning

Use tools (Nmap, Nessus) to scan for vulnerabilities in network, services, and applications

Exploitation

Attempt to exploit found vulnerabilities to gain access — staying within agreed scope

Post-exploit

Determine what could be accessed with the gained privileges; test for lateral movement

Reporting

Document all findings: vulnerabilities, severity, evidence, and recommended remediation

Penetration Testing vs Hacking

Aspect	Penetration Testing	Criminal Hacking
Permission	Written authorisation from the organisation	No permission — illegal
Scope	Agreed and limited scope	No limits
Intent	Find and report vulnerabilities to improve security	Exploit for financial gain, espionage, disruption
Outcome	Detailed report with remediation advice	Damage, data theft, disruption
Legal status	Legal (under the Computer Misuse Act when authorised)	Illegal under the Computer Misuse Act

Network Forensics & Audit Logs

Network forensics is the collection, analysis, and preservation of network data to investigate security incidents. After a breach, forensic analysis determines: what happened, when, how, what data was accessed, and who was responsible.

Audit logs record all significant system events — logins, file access, configuration changes, failed attempts. They provide an audit trail for forensic investigation. Logs must be stored securely and in a tamper-proof format — otherwise attackers may delete them to cover their tracks.

Vulnerability Scanning

An automated form of finding weaknesses — scanning software (e.g. Nessus, OpenVAS) checks systems against a database of known vulnerabilities. Less thorough than pen testing (no exploitation), but faster and cheaper. Used routinely to monitor for newly disclosed vulnerabilities in software versions in use.

Exam tip: The key difference between pen testing and hacking is authorisation (written permission). Know the three types: white box (full knowledge), black box (no knowledge), grey box (partial). For network forensics, know that audit logs provide the trail needed to investigate incidents — and must be protected from tampering.

⚠️ Common Mistakes

Saying pen testing is illegal — it is legal when properly authorised in writing. Without authorisation it would be illegal under the Computer Misuse Act.
Confusing white/black box: white = most information (not "most secret"); black = no prior knowledge (not "most dangerous").
Thinking vulnerability scanning = penetration testing — scanning finds potential weaknesses automatically; pen testing involves a skilled human actually attempting to exploit them.

▶

Video coming soon

Key points

Pen testing = authorised simulated attack to find vulnerabilities before real attackers do
Types: white box (full knowledge), black box (no knowledge), grey box (partial)
Stages: reconnaissance → scanning → exploitation → post-exploit → report
Pen testing is legal with permission; without permission = criminal hacking under Computer Misuse Act
Network forensics: collecting/analysing logs and data after an incident to understand what happened
Audit logs: tamper-proof records of system events — essential for forensic investigation

Click slide or press arrow keys to navigate

✍️

Worksheet — 3.6.3b Penetration Testing

8 questions · 19 marks

Q1What is penetration testing? How does it differ from criminal hacking?[3]

✅ Mark scheme

Mark scheme

Penetration testing is an authorised, simulated cyber attack performed by security professionals to identify vulnerabilities in a system [1]; it differs from criminal hacking in that: (a) it is performed with written permission from the organisation [1]; (b) the intent is to find and report vulnerabilities to improve security, not to steal data or cause damage [1].

Q2Explain the difference between a white box and a black box penetration test.[2]

✅ Mark scheme

Mark scheme

White box: the pen tester has full knowledge of the system — architecture, source code, credentials; simulates an insider threat or post-breach attacker; most thorough [1]; black box: the pen tester has no prior knowledge of the system; simulates a complete outsider/external attacker; most realistic but may miss issues that require insider knowledge [1].

Q3List the five stages of a penetration test in order.[2]

✅ Mark scheme

Mark scheme

1. Reconnaissance (gathering information about the target) [1]; 2. Scanning (identify open ports, services, vulnerabilities); 3. Exploitation (attempt to exploit vulnerabilities within agreed scope); 4. Post-exploitation (determine scope of access achieved); 5. Reporting (document findings, severity, and remediation advice) [1].

Q4What is the purpose of the reporting stage in penetration testing?[2]

✅ Mark scheme

Mark scheme

The reporting stage documents all vulnerabilities discovered during the test, their severity level (critical/high/medium/low), evidence of successful exploitation, and recommended remediation steps [1]; this allows the organisation to prioritise and fix the most serious weaknesses before real attackers can exploit them [1].

Q5What is an audit log? Why are audit logs important for network security?[3]

✅ Mark scheme

Mark scheme

An audit log is a chronological record of significant system events — logins, file access, configuration changes, failed authentication attempts, network connections [1]; they are important for: (a) detecting suspicious activity in real time [1]; (b) providing a forensic trail after a security incident — allowing investigators to determine what happened, when, and who was responsible [1].

Q6Why must audit logs be stored in a tamper-proof format and backed up securely?[2]

✅ Mark scheme

Mark scheme

If logs are not tamper-proof, an attacker who gains access to a system can modify or delete the logs to cover their tracks, making it impossible to investigate the breach [1]; secure, backed-up logs in read-only or cryptographically signed format ensure the audit trail is preserved for forensic investigation and legal proceedings [1].

Q7How does vulnerability scanning differ from penetration testing?[2]

✅ Mark scheme

Mark scheme

Vulnerability scanning is automated — software tools check a system against a database of known vulnerabilities without attempting to exploit them [1]; penetration testing involves a skilled human security professional actively attempting to exploit vulnerabilities, going deeper to understand real-world risk and chain multiple vulnerabilities together [1].

Q8A financial company wants to test whether its new online banking system is secure. Explain why they would commission a grey box penetration test and what this involves.[3]

✅ Mark scheme

Mark scheme

A grey box test simulates a realistic threat — an attacker who has already gained some access (e.g. a compromised customer account) [1]; the pen tester is given partial knowledge (e.g. a standard user account) but not full access to source code or system architecture [1]; this tests whether someone who has breached the outer defences can escalate privileges, access other accounts, or reach sensitive data — the most common real-world attack scenario [1].

✓

Check your answers above.

Topic Quiz

Q 1 of 10

You scored

out of 10

Card 1 of 7

Click to flip

🎉

All done!

Term	Definition

🔒

Pro Content

Subscribe to unlock all AQA 8525 lessons, worksheets, quizzes and mini tests.

£7.99/month

or £59/year

Upgrade to Pro

What is Penetration Testing?

Types of Penetration Test

White Box

Black Box

Grey Box

Stages of a Penetration Test

Penetration Testing vs Hacking

Network Forensics & Audit Logs

Vulnerability Scanning

Key points

Worksheet — 3.6.3b Penetration Testing

Mini Test — 3.6.3b Pen Testing