Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A vulnerability scan of a mixed environment (Windows and Linux servers) produces a large number of findings. The analyst notices that many findings are duplicates or false positives due to the scanner's configuration. The analyst has limited time to review the results. Which approach best ensures the final report is accurate and actionable?

   • AReport all findings as-is, including duplicates and false positives, to avoid missing anything.
   • BAutomatically exclude all findings that appear on both Windows and Linux servers.
   • CRun the scan again with a different tool and only report findings that appear in both scans.
   • DUse a risk-based scoring system to prioritize findings, then manually validate the top critical and high findings.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which phase of penetration testing involves gathering information about the target without actively engaging with it?

   • AReconnaissance
   • BPost-exploitation
   • CScanning
   • DExploitation
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company wants to assess the security of its external perimeter from an attacker's perspective. They provide the testing team with no prior knowledge of the network, but they do authorize the test. Which type of penetration test is being conducted?

   • ABlack-box penetration test
   • BRed-team exercise
   • CGray-box penetration test
   • DWhite-box penetration test
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of a vulnerability assessment?

   • ATo test the effectiveness of security controls by simulating a real-world attack
   • BTo actively exploit identified weaknesses to determine the extent of potential damage
   • CTo verify that all security patches have been applied and no vulnerabilities exist
   • DTo identify, classify, and report security weaknesses in systems and networks without exploiting them
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A vulnerability management team is planning a quarterly assessment. They must avoid disrupting business-critical systems and ensure the report is actionable. Which sequence of steps best aligns with the vulnerability assessment process?

   • AStart with exploitation of critical systems to confirm vulnerabilities, then scan the rest of the network.
   • BDefine scope, perform credentialed scans during maintenance windows, analyze findings for false positives, and report with remediation priorities.
   • CScan all systems immediately, report all raw findings, and let each team decide what to fix.
   • DRun an unauthenticated scan, then immediately patch all identified vulnerabilities without further analysis.
   Reveal Solution Discussion Select an answer first