Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A penetration test is being conducted on a third-party cloud service. The CISO must ensure the test is authorized and does not violate the cloud provider's terms of service. Which step is most important before starting the test?

   • AObtain written permission from the cloud provider.
   • BUse only passive scanning techniques.
   • CSign a non-disclosure agreement with the penetration testing team.
   • DEnsure the test is conducted from the organization's own IP addresses.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A CISO is planning a penetration test that will involve social engineering of employees. The test is intended to assess the effectiveness of security awareness training. The CISO must ensure the test is legally and ethically sound. Which step is essential before conducting the social engineering test?

   • AConduct the test without any documentation to avoid liability.
   • BEnsure the test does not involve any form of deception.
   • CObtain written authorization from senior management and legal counsel.
   • DInform all employees about the test in advance.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration testing team has completed an engagement and is preparing the final report. The report includes a critical finding that was successfully exploited, a high finding that could not be exploited due to a security control, and several medium findings. The client's management is focused on the critical finding and wants to allocate all resources to fix it. The CISO wants the report to guide a balanced remediation strategy. What should the report emphasize?

   • AA risk-based remediation plan that addresses the critical finding first but also schedules the high and medium findings based on their exploitability and business impact.
   • BOnly the critical finding, since it was successfully exploited and represents the most immediate threat to the organization.
   • CA recommendation to re-test the critical finding after remediation and defer all other findings to the next scheduled assessment.
   • DThe high finding that could not be exploited, since it indicates a control failure that needs immediate attention.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which tool is commonly used for network vulnerability scanning?

   • AWireshark
   • BBurp Suite
   • CNessus
   • DMetasploit
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank has completed a vulnerability scan of its internet-facing web application and received a report with 40 findings. The CISO asks the security team to prioritize remediation efforts for the next sprint. The team has limited patching capacity and must address the most critical issues first. The report includes a SQL injection flaw in the login form (CVSS 9.8), a missing HTTP security header (CVSS 5.3), an outdated TLS version (CVSS 7.4), and a verbose error message disclosure (CVSS 3.1). Which approach should the team take to align with industry best practices?

   • ATreat all findings as equal priority because CVSS scores do not account for the bank's specific threat model, so a custom scoring system must be built before any action.
   • BFix the verbose error messages first because they are the easiest to resolve, then move to the missing header, TLS, and SQL injection as time permits.
   • CPatch the SQL injection first, then the TLS version, then the missing header, and finally the verbose error messages, using CVSS scores as the primary sorting criterion.
   • DRemediate all findings in the order they appear in the scanner's raw output, since the scanner already ranks them by severity.
   Reveal Solution Discussion Select an answer first