Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization wants to test its internal network security. They provide the testers with network diagrams, credentials, and source code to speed up the test. What type of penetration test is this?

   • ABlack-box penetration test
   • BWhite-box penetration test
   • CGray-box penetration test
   • DExternal penetration test
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A client requests a penetration test of their internal network. The client is concerned about the risk of the test causing an outage. The tester proposes a white-box test with a detailed rules of engagement. The client asks why a white-box test is safer than a black-box test. Which response is most accurate?

   • AWhite-box tests do not use any exploitation techniques, so they cannot cause outages.
   • BWhite-box tests are safer because they do not require scanning, which is the main cause of outages.
   • CWhite-box tests have a smaller attack surface because the tester already knows the network, reducing the chance of unexpected impacts.
   • DWhite-box tests are always less risky because they are performed during business hours.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration test report includes a finding that the tester was able to extract sensitive data from a database. The client's management is concerned about the risk and wants to know the business impact. The report currently only lists the technical details of the vulnerability. What should the tester add to the report to address management's concern?

   • AA business impact analysis that explains the potential financial, legal, and reputational consequences.
   • BA list of all the tools used during the test.
   • CA detailed exploit proof-of-concept code.
   • DA recommendation to purchase additional security tools.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager needs to decide between conducting a vulnerability assessment or a penetration test for a new web application. The goal is to identify as many potential weaknesses as possible in a short time, without the risk of disrupting production. Which approach is more appropriate?

   • ABoth, because they are the same thing.
   • BPenetration test, because it provides a more thorough analysis of security controls.
   • CVulnerability assessment, because it uses automated scans to identify potential weaknesses without exploiting them.
   • DNeither, because automated tools are unreliable.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is planning a penetration test for a web application. They need a methodology that provides detailed guidance for testing web application security, including OWASP Top 10 coverage. Which methodology should they follow?

   • AOWASP Testing Guide
   • BPTES
   • CISO 27001
   • DOSSTMM
   Reveal Solution Discussion Select an answer first