Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How does penetration testing validate security controls?

   • ABy interviewing system administrators about security policies
   • BBy analyzing vulnerability scan reports
   • CBy reviewing configuration settings of firewalls and IDS
   • DBy attempting to bypass those controls through real attack techniques
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A CISO is commissioning a penetration test of a new customer-facing web application. The test must simulate an external attacker with no prior knowledge of the application. The CISO also wants to ensure the test does not violate any laws or regulations. Which type of penetration test should be performed?

   • AInternal testing from within the corporate network.
   • BBlack-box testing with no prior knowledge of the application.
   • CWhite-box testing with full source code access.
   • DGray-box testing with partial knowledge of the application.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has completed a vulnerability scan and is reviewing the results. The scan found a critical vulnerability in a legacy application that is scheduled for decommissioning in six months. The same scan found a medium-severity vulnerability in a new customer-facing application that processes sensitive data. The team has limited resources and must decide where to focus. The CISO wants a risk-based decision. What should the team do?

   • APrioritize the medium-severity vulnerability in the customer-facing application because it exposes sensitive data and has a longer expected lifespan.
   • BPrioritize the critical vulnerability in the legacy application because CVSS score is the only objective measure of risk.
   • CDefer both findings until the next scheduled scan, since the vulnerabilities have existed for some time and no active exploitation has been observed.
   • DRemediate both vulnerabilities simultaneously, since both are valid findings and all vulnerabilities must be fixed regardless of context.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration testing team is using the OWASP Testing Guide to assess a web application. The team is currently in the 'Phase 2: Initiation' stage. What should the team do in this stage?

   • AWrite the final report.
   • BDefine the scope and objectives of the test.
   • CPerform active scanning of the application.
   • DExploit identified vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which ethical principle is most important for a penetration tester to follow?

   • AKeeping all findings confidential from the client
   • BExploiting any vulnerability discovered, regardless of scope
   • CUsing the most aggressive techniques to ensure thorough testing
   • DStaying within the defined scope of the engagement
   Reveal Solution Discussion Select an answer first