Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In which type of penetration test does the tester have no prior knowledge of the target environment?

   • ABlack-box testing
   • BInternal testing
   • CGray-box testing
   • DWhite-box testing
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company has a mix of Windows servers, Linux servers, and network devices. The security team needs to identify missing security patches and common misconfigurations across all of these assets on a recurring basis. The team has a limited budget and wants a single tool that can perform authenticated scans and produce standardized severity scores. Which tool selection best meets these requirements?

   • ANessus Professional, configured with credential-based scan policies for each operating system and network device family.
   • BMetasploit's auxiliary scanner modules to probe each asset for known vulnerabilities and automatically exploit any that are found.
   • CNmap with the NSE vulnerability scripts, run as a non-authenticated scan to avoid the complexity of managing credentials.
   • DWireshark to capture and analyze network traffic for signs of known exploit attempts against unpatched services.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration testing team is using the PTES methodology to conduct a test. The team has completed the pre-engagement interactions and intelligence gathering phases. What should the team do next according to PTES?

   • AProceed to threat modeling and vulnerability identification.
   • BConduct post-exploitation activities.
   • CBegin exploitation of identified vulnerabilities.
   • DWrite the final report.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the key difference between internal and external penetration testing?

   • AInternal testing is performed from inside the network, while external testing is performed from outside the network
   • BExternal testing focuses on web applications, while internal testing focuses on networks
   • CInternal testing is always black-box, while external testing is always white-box
   • DInternal testing is more expensive than external testing
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which phase of penetration testing involves gathering information about the target without actively engaging systems?

   • AExploitation
   • BScanning
   • CPost-exploitation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first