Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a penetration testing methodology like PTES?

   • ATo replace the need for skilled penetration testers
   • BTo automatically exploit vulnerabilities without human intervention
   • CTo certify that a system is completely secure
   • DTo provide a standardized, repeatable process for conducting penetration tests
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester is hired to assess the security of a company's internal network. The tester is given a standard user account and is told to attempt to escalate privileges. What type of penetration test is this?

   • AGray-box testing
   • BWhite-box testing
   • CExternal testing
   • DBlack-box testing
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is assessing a client's web application. The tester has identified a potential SQL injection vulnerability in the login form. To confirm the vulnerability and determine its impact, the tester needs to craft and send malicious payloads to the application. Which tool is most appropriate for this task?

   • ABurp Suite, because it allows the tester to intercept, modify, and replay HTTP requests to test for SQL injection.
   • BAircrack-ng, because it can test the wireless network used to access the application for vulnerabilities.
   • CWireshark, because it can capture and analyze the network traffic between the tester and the application to identify injection attempts.
   • DNmap, because it can scan the application for open ports and identify the database server behind the application.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does a CVSS score primarily help an organization?

   • ABy replacing the need for manual risk assessment
   • BBy automatically generating compliance reports
   • CBy identifying the exact exploit code needed to attack a vulnerability
   • DBy ranking vulnerabilities to prioritize remediation efforts
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which standard penetration testing methodology is specifically focused on web application security?

   • AISO 27001
   • BPTES
   • COSSTMM
   • DOWASP Testing Guide
   Reveal Solution Discussion Select an answer first