Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst at a mid-sized company runs a quarterly vulnerability scan against all internal web servers. The scan report flags a critical SQL injection vulnerability in a legacy HR application. The analyst reviews the raw scan output and notices the finding is based on a pattern match in the HTTP response body, not an actual injected payload. The application team confirms the input is parameterized. What should the analyst do with this finding?

   • AReport it as a critical vulnerability and demand immediate remediation.
   • BMark it as a false positive and remove it from the report without further action.
   • CEscalate the finding to the CISO immediately because the scanner flagged it as critical.
   • DValidate the finding manually with a safe test payload, then document the result and exclude it from the risk-prioritized list if confirmed false.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is in the exploitation phase of a test. The tester has identified a vulnerable web application and needs to gain a foothold on the target server. Which tool is most appropriate for this task?

   • ABurp Suite, to intercept and modify web traffic.
   • BNmap, to scan for open ports on the target.
   • CMetasploit, to launch an exploit against the identified vulnerability.
   • DWireshark, to capture network traffic during the attack.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team needs to assess the security posture of a large network. They want to identify open ports, running services, and potential vulnerabilities across thousands of IP addresses. They also need to generate reports that can be shared with management. Which tool is most appropriate for this task?

   • ANessus, because it is a comprehensive vulnerability scanner that can scan large networks and generate detailed reports.
   • BWireshark, because it can capture and analyze network traffic to identify vulnerabilities.
   • CMetasploit, because it can exploit vulnerabilities and provide a report of successful attacks.
   • DNmap, because it is a powerful network scanner that can identify open ports and services.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does a vulnerability assessment differ from a penetration test?

   • AA vulnerability assessment identifies and reports vulnerabilities, while a penetration test attempts to exploit them to demonstrate impact
   • BA vulnerability assessment is performed only on external systems, while a penetration test covers internal systems
   • CA vulnerability assessment is required by compliance standards, while a penetration test is optional
   • DA vulnerability assessment is automated, while a penetration test is always manual
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which tool is commonly used for network vulnerability scanning?

   • AWireshark
   • BBurp Suite
   • CNessus
   • DMetasploit
   Reveal Solution Discussion Select an answer first