Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After a vulnerability assessment, a CISO must present findings to the board of directors. The board is not technical and needs to understand the business impact of the vulnerabilities. What is the most effective way to present the findings?

   • AProvide a detailed technical report with CVSS scores and exploit code.
   • BPresent a list of all vulnerabilities without prioritization.
   • CFocus only on the vulnerabilities that have known exploits.
   • DSummarize the findings in terms of risk to business operations, with a prioritized action plan.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is assessing a client's internal network. During the reconnaissance phase, the tester identified a wireless network used by employees. The client wants to know if the wireless network could be used as an entry point to the corporate network. Which tool should the tester use to assess the wireless network's security?

   • AAircrack-ng suite to capture and analyze wireless traffic, test WPA2 handshakes, and attempt to crack weak passphrases.
   • BWireshark to capture wireless packets and analyze application-layer protocols for vulnerabilities.
   • CNmap to scan the wireless network for open ports and running services on connected devices.
   • DBurp Suite to intercept and modify wireless traffic between the access point and client devices.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a vulnerability assessment?

   • ATo simulate a real-world attacker's actions to test incident response
   • BTo actively exploit identified weaknesses to demonstrate business impact
   • CTo identify, classify, and report security weaknesses without exploiting them
   • DTo verify that all security controls are functioning as designed
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is planning a penetration test for a client's internal network. The client has provided the team with network diagrams, configuration files, and a standard user account with limited privileges. The client wants to understand what an insider with basic access could achieve. Which type of penetration test does this scenario describe?

   • AExternal testing, because the team is testing from outside the network perimeter.
   • BGray-box testing, because the team has partial knowledge of the environment and a low-privilege account.
   • CWhite-box testing, because the team has full knowledge of the environment and complete access to all systems.
   • DBlack-box testing, because the team has no prior knowledge of the environment and must discover everything from scratch.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency is planning its first vulnerability assessment. The agency has a mix of classified and unclassified systems. The CISO needs to ensure that the assessment does not expose classified information to unauthorized personnel. Which step of the vulnerability assessment process is most critical to address this requirement?

   • AScoping, by clearly defining which systems are in scope and which are explicitly excluded, along with the handling requirements for any data encountered.
   • BReporting, by redacting all system names and IP addresses in the final report to protect sensitive information.
   • CScanning, by using only non-intrusive scanning techniques that cannot access sensitive data on the target systems.
   • DAnalysis, by having only cleared personnel review the scan results and remove any classified data before reporting.
   Reveal Solution Discussion Select an answer first