Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a penetration test, the tester has successfully gained access to a database server. The next step is to determine the value of the compromised data and identify other systems that can be reached from this server. Which phase of the penetration test is this?

   • AReconnaissance
   • BReporting
   • CExploitation
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A compliance requirement mandates that the organization identify and document vulnerabilities in its environment on a regular basis. The organization does not need to prove exploitability. Which activity should be performed to meet this requirement?

   • APerform a penetration test that includes exploitation of all critical findings
   • BConduct a vulnerability assessment using automated scanning and manual verification
   • CRun a port scan and document open ports only
   • DReview firewall rules and document any misconfigurations
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When prioritizing vulnerabilities for remediation, which factor is most important to consider?

   • AThe order in which vulnerabilities were discovered
   • BThe ease of patching
   • CThe number of vulnerabilities found
   • DThe risk rating, which combines the likelihood of exploitation and potential impact
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A vulnerability scan report lists a critical vulnerability on a server that is exposed to the internet. The vulnerability is a known remote code execution flaw. However, the server is protected by a web application firewall (WAF) that blocks the exploit. How should the analyst prioritize this finding?

   • ATreat it as a high priority because the WAF could be bypassed or misconfigured
   • BIgnore the finding because the WAF fully mitigates the risk
   • CDowngrade it to low priority because the WAF is in place
   • DReport it as a false positive because the WAF blocks the exploit
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A vulnerability management team is planning a quarterly assessment for a network with 500 hosts, including critical production servers and employee workstations. The team must minimize disruption to business operations while still identifying high-risk vulnerabilities. Which scoping decision best balances these needs?

   • AScan all hosts, but schedule scans during maintenance windows and use safe scan profiles for production systems.
   • BScan only the workstations because they are the most likely to be compromised.
   • CScan all hosts during business hours to get the most accurate results.
   • DScan only the critical production servers and skip workstations to save time.
   Reveal Solution Discussion Select an answer first