Vulnerability Assessments and Penetration Testing ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   After a vulnerability scan, the analyst sees a critical finding on a web server. The finding is based on a version string that appears outdated, but the server is actually patched behind a load balancer. What should the analyst do with this finding?

   • AMark it as a false positive and exclude it from the final report.
   • BEscalate the finding to the incident response team for immediate action.
   • CIgnore the finding because it came from an automated scan.
   • DReport it as critical and require immediate patching.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A vulnerability scan identifies a critical remote code execution vulnerability on an internet-facing server. The server is scheduled for decommissioning in three months, and the patch requires a reboot that will cause a two-hour outage. The organization has a 99.9% uptime SLA. What is the best course of action?

   • AApply the patch during the next scheduled maintenance window, accepting the brief outage
   • BImplement a WAF rule and defer patching until the server is decommissioned
   • CDo not patch because the server will be decommissioned soon
   • DImmediately reboot the server without coordination to patch it as soon as possible
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key capability of vulnerability scanning tools?

   • AThey can exploit vulnerabilities to gain access to systems
   • BThey can automatically patch identified vulnerabilities
   • CThey can guarantee the absence of all vulnerabilities
   • DThey can compare scan results against databases of known vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary objective of a penetration test?

   • ATo identify as many vulnerabilities as possible in the shortest time
   • BTo patch all identified vulnerabilities
   • CTo ensure compliance with industry regulations
   • DTo exploit vulnerabilities to determine the real-world impact on the organization
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A penetration test report includes a critical finding: an unauthenticated remote code execution vulnerability in a public-facing application. The remediation recommendation is to apply a vendor patch. However, the patch requires a 30-minute downtime and the application is business-critical. The client asks for an alternative remediation that does not require downtime. Which recommendation is most appropriate?

   • AApply the patch during the next scheduled maintenance window, even if it is weeks away.
   • BIgnore the finding because the patch is disruptive.
   • CDisable the application until the patch can be applied.
   • DImplement a web application firewall (WAF) rule to block exploit attempts as a temporary mitigation, then schedule the patch.
   Reveal Solution Discussion Select an answer first