What is the purpose of an attack path map in planning a penetration test?

• A. To visualize potential attack paths and techniques, helping both the pentester and the client understand steps to compromise high-value targets.
• B. To track network topologies only.
• C. To measure system performance.
• D. To log all user activity for auditing.

Answer: (A)

Visualizing potential routes an attacker could take from initial access to a high-value target, including the techniques that might be used at each step, is the essence of an attack path map. This helps both the tester and the client see how a compromise could unfold and which assets are most at risk, so planning can be focused on those critical sequences. In practice, it guides scoping and prioritization—you target the most plausible attack chains, decide the order of testing to mirror real-world progression, and present risk scenarios that stakeholders can grasp. It’s not about tracking network topology alone, measuring system performance, or logging user activity, which are separate concerns.