Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which tool is primarily used for network reconnaissance and port scanning?

   • ANmap
   • BSqlmap
   • CJohn the Ripper
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A penetration test report lists a critical SQL injection vulnerability in a customer-facing application. The remediation team is concerned that the proposed fix (input validation) might break existing functionality. The team must balance security with business continuity. What is the most appropriate recommendation?

   • AImmediately block all input to the application until a fix is developed
   • BImplement parameterized queries and perform regression testing before deployment
   • CIgnore the finding because the application is behind a firewall
   • DApply a WAF rule to block SQL injection attempts and defer code changes
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company wants to test its incident response capabilities by simulating a realistic attack. The testing team is given no prior knowledge of the network and must discover vulnerabilities and exploit them from an external perspective. Which type of penetration test is this?

   • AWhite-box test, because the team has full knowledge of the target.
   • BRed-team test, because it focuses on evading detection.
   • CBlack-box test, because the team has no prior knowledge of the target.
   • DGray-box test, because the team has partial knowledge of the target.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A penetration testing team is planning an assessment for a client's e-commerce platform. The client requires the test to follow a recognized methodology that emphasizes business-impact analysis and provides a structured framework for reporting. The team also needs to ensure the test includes a post-exploitation phase to demonstrate the potential impact of a breach. Which methodology should the team select?

   • APTES, because it provides a comprehensive framework with a dedicated reporting phase and emphasizes business impact.
   • BISO 27001, because it is an international standard for information security management.
   • COSSTMM, because it focuses on operational security metrics and is vendor-neutral.
   • DOWASP Testing Guide, because it focuses on web application security and includes post-exploitation.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security analyst at a mid-sized company is asked to identify weaknesses in the environment without attempting to exploit them. The goal is to produce a prioritized list of missing patches and misconfigurations for the IT team to remediate. Which activity best matches this request?

   • ARun an authenticated vulnerability scan against production systems and analyze the results for true positives.
   • BReview firewall logs to identify attempted attacks and block the source IP addresses.
   • CConduct a network discovery scan to inventory all devices and open ports on the network.
   • DPerform a full penetration test that includes exploiting a critical vulnerability to prove business impact.
   Reveal Solution Discussion Select an answer first