Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration testing team is asked to assess a web application that handles financial transactions. The client wants the test to focus on the most common web application vulnerabilities, such as injection, broken authentication, and cross-site scripting. Which methodology should the team use?

   • AISO 27005, because it is a risk management standard.
   • BOWASP Testing Guide, because it provides a framework for testing web application security.
   • COSSTMM, because it is a vendor-neutral methodology.
   • DPTES, because it is a comprehensive penetration testing standard.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester has completed the exploitation phase and now needs to document the findings, including the vulnerabilities exploited and the data accessed. Which phase of the penetration test is this?

   • APost-exploitation
   • BScanning
   • CReconnaissance
   • DReporting
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of using a recognized penetration testing methodology like PTES or OSSTMM?

   • ATo ensure the test is conducted in a consistent, repeatable, and comprehensive manner
   • BTo guarantee that all vulnerabilities will be found
   • CTo eliminate the need for manual testing
   • DTo automate the entire penetration testing process
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration testing team is planning a test for a client that requires compliance with PCI DSS. The client wants the test to be as comprehensive as possible but also wants to minimize the risk of disrupting production systems. The team must choose a methodology that is recognized and can be tailored to the client's needs. Which methodology should they choose?

   • AOWASP Testing Guide, because it is the only methodology recognized by PCI DSS.
   • BISO 27001, because it is an international standard that covers penetration testing.
   • CPTES, because it is comprehensive and can be tailored to include the required PCI DSS testing components.
   • DOSSTMM, because it is the only methodology that is compliant with PCI DSS.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of a remediation strategy in the context of a penetration test report?

   • ATo provide a detailed log of all actions taken during the test
   • BTo assign blame for the security weaknesses
   • CTo outline steps to fix identified vulnerabilities and reduce risk
   • DTo justify the cost of the penetration test
   Reveal Solution Discussion Select an answer first