A vulnerability scan of a corporate network reveals the following findings: a critical remote code execution vulnerability in a public-facing web server, a high-severity SQL injection in an internal HR application, and a medium-severity missing patch on a development server. The organization has limited resources and must prioritize remediation. Which vulnerability should be addressed first?

The SQL injection in the internal HR application, because it exposes sensitive employee data.

All three equally, because all vulnerabilities should be fixed immediately.

The remote code execution on the public-facing web server, because it is critical and internet-facing.

The missing patch on the development server, because it is easy to fix.

What is the correct sequence of the main steps in a vulnerability assessment?

Reporting, scoping, scanning, analysis

Scanning, scoping, analysis, reporting

Analysis, scoping, scanning, reporting

Scoping, scanning, analysis, reporting

A vulnerability assessment team is preparing to scan a mixed environment that includes legacy systems that are sensitive to aggressive scanning. The team wants to minimize the risk of disruption while still getting useful data. What should they do?

Run unauthenticated scans at maximum intensity to get results quickly

Use credentialed scans with a low scan intensity and schedule them during maintenance windows

Scan all systems with the same settings to ensure consistency

Skip scanning legacy systems to avoid any risk of disruption

A vulnerability assessment team is planning a scan of a network that includes industrial control systems (ICS) and traditional IT systems. The team is concerned about the impact of active scanning on the ICS devices, which are sensitive to network traffic. Which approach best balances the need to assess the ICS environment with the risk of disruption?

Use a more aggressive scan profile on the ICS devices to get faster results.

Scan the ICS devices with the same active scanner used for IT systems to ensure consistency.

Exclude the ICS devices from the scan entirely to avoid any risk.

Use passive network monitoring for ICS devices and active scanning for IT systems.

After a penetration test, the tester must write a report that helps the organization prioritize remediation. Which element is most important to include for each finding?

The total number of vulnerabilities found

The exact exploit code used during the test

The name of the tester who found the vulnerability

A risk rating based on the likelihood and impact of exploitation

EC-CouncilAssociate C|CISO

Domain 4Objective 7

Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 6)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 26–30

26application · medium
A vulnerability scan of a corporate network reveals the following findings: a critical remote code execution vulnerability in a public-facing web server, a high-severity SQL injection in an internal HR application, and a medium-severity missing patch on a development server. The organization has limited resources and must prioritize remediation. Which vulnerability should be addressed first?
Select an answer first
27foundation · easy
What is the correct sequence of the main steps in a vulnerability assessment?
Select an answer first
28application · medium
A vulnerability assessment team is preparing to scan a mixed environment that includes legacy systems that are sensitive to aggressive scanning. The team wants to minimize the risk of disruption while still getting useful data. What should they do?
Select an answer first
29expert · hard
A vulnerability assessment team is planning a scan of a network that includes industrial control systems (ICS) and traditional IT systems. The team is concerned about the impact of active scanning on the ICS devices, which are sensitive to network traffic. Which approach best balances the need to assess the ICS environment with the risk of disruption?
Select an answer first
30application · medium
After a penetration test, the tester must write a report that helps the organization prioritize remediation. Which element is most important to include for each finding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 6)

Questions 26–30

What is the correct sequence of the main steps in a vulnerability assessment?

A vulnerability assessment team is preparing to scan a mixed environment that includes legacy systems that are sensitive to aggressive scanning. The team wants to minimize the risk of disruption while still getting useful data. What should they do?

After a penetration test, the tester must write a report that helps the organization prioritize remediation. Which element is most important to include for each finding?

Keep studying — Information Security Core Competencies