Which set lists the primary phases of the eJPT penetration testing methodology?

• A. Reconnaissance, Scanning/Enumeration, Vulnerability Identification, Exploitation (Gaining Access), Post-Exploitation, and Reporting.
• B. Planning, Scoping, Execution, Review
• C. Discovery, Enumeration, Breach, Exfiltration
• D. Observation, Infiltration, Analysis, Disclosure

Answer: (A)

The sequence reflects the practical flow of a hands-on penetration test, moving from information gathering through to delivering results. Reconnaissance focuses on collecting data about the target to build an initial map. Scanning and enumeration follow, identifying live systems, open ports, services, and potential weaknesses. Vulnerability identification then analyzes those findings to pinpoint exploitable flaws. Exploitation (gaining access) uses those weaknesses to break in and demonstrate access to systems. Post-exploitation covers what you do after gaining access—maintaining presence, pivoting to other systems, and gathering evidence while staying under the radar. Finally, reporting documents all findings, evidence, risk, and remediation steps for the client.

The other sets don’t line up with how a penetration test is typically conducted in practice. They either describe generic project lifecycles (planning, scoping, execution, review) or mix activities in a way that doesn’t reflect the standard progression from discovery to exploitation to post-access activities and formal reporting.