Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is preparing for a regulatory audit and wants to validate that its newly deployed web application firewall (WAF) and intrusion prevention system (IPS) actually block known attack patterns. The CISO authorizes a test that simulates real-world attacker behavior against the production environment, but the testers are given no credentials, no architecture diagrams, and no source code. The test must not disrupt live patient-facing services. Which type of engagement best matches this requirement?

   • AA gray-box vulnerability assessment that provides testers with low-privilege credentials but no exploit attempts, focusing only on configuration review.
   • BAn internal white-box penetration test where testers have full network access and source code to maximize coverage of the WAF and IPS rules.
   • CAn unannounced red-team exercise with no advance notice to the security operations center to test their detection and response capabilities.
   • DAn external black-box penetration test with a signed rules of engagement that limits testing to non-destructive payloads and off-peak hours.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester has been hired to assess a client's network. During the engagement, the tester discovers a critical vulnerability in a third-party application that is also used by other organizations. The client's contract does not mention disclosure of vulnerabilities to third parties. What should the tester do?

   • ADisclose the vulnerability directly to the third-party vendor immediately, since it affects other organizations and is a public safety issue.
   • BPublish the vulnerability publicly to warn other organizations, since the tester has a duty to protect the broader community.
   • CIgnore the vulnerability since it is in a third-party application and not part of the client's scope.
   • DReport the vulnerability to the client and include a recommendation that the client notify the third-party vendor, while respecting the terms of the engagement.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement best distinguishes a vulnerability assessment from a penetration test?

   • AA vulnerability assessment is automated, while a penetration test is always manual
   • BA vulnerability assessment identifies weaknesses, while a penetration test exploits them to validate impact
   • CA vulnerability assessment is performed by internal staff, while a penetration test is performed by external consultants
   • DA vulnerability assessment focuses on web applications, while a penetration test focuses on networks
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What does the Common Vulnerability Scoring System (CVSS) provide?

   • AA tool for automatically patching vulnerable systems
   • BA standardized method for rating the severity of security vulnerabilities
   • CA list of known vulnerabilities in software products
   • DA framework for conducting penetration tests
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration testing team has successfully exploited a vulnerability in a client's web application and gained access to the application server. The team's objective is to demonstrate the potential business impact of the compromise. The client is particularly concerned about the confidentiality of customer data stored in a backend database. According to the penetration testing phases, what should the team do next?

   • AClean up all traces of the exploitation and end the test, since the objective has been met by gaining access to the server.
   • BReturn to the scanning phase to identify additional vulnerabilities in the database server before proceeding.
   • CBegin the reporting phase immediately, documenting the successful exploitation and the potential for data access without actually accessing the database.
   • DMove to post-exploitation to enumerate the database, extract a sample of customer data, and document the potential impact.
   Reveal Solution Discussion Select an answer first