Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the main purpose of the reporting phase in a penetration test?

   • ATo exploit additional vulnerabilities discovered during the test
   • BTo obtain authorization for the test
   • CTo document findings, evidence, and remediation recommendations for stakeholders
   • DTo clean up any changes made to the target systems
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university's IT department runs a quarterly vulnerability scan across its campus network. The latest scan identified a critical remote code execution vulnerability in a legacy research server. The IT team verifies the finding and applies the vendor patch. The CISO asks for a follow-up action to confirm the vulnerability is actually remediated. What is the most appropriate next step?

   • AClose the finding in the vulnerability management system immediately, since the patch was applied successfully.
   • BConduct a full penetration test of the entire network to ensure no other vulnerabilities exist before closing the finding.
   • CWait until the next quarterly scan to see if the vulnerability reappears, to avoid consuming additional scanning resources.
   • DRun a targeted rescan of the affected server to confirm the vulnerability no longer appears in the scan results.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A vulnerability scan has identified a critical vulnerability in a custom application. The CVSS score is 9.8, but the application is only accessible internally and requires authentication. The CISO must decide whether to remediate immediately or defer. Which factor should most influence the decision?

   • AThe likelihood of exploitation given the internal access and authentication requirements.
   • BThe CVSS score alone, since it is critical.
   • CThe age of the vulnerability, since older vulnerabilities are more dangerous.
   • DThe cost of remediation, regardless of risk.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key characteristic of an effective vulnerability assessment report?

   • AIt lists every vulnerability without prioritization
   • BIt focuses only on technical details for IT staff
   • CIt includes actionable remediation recommendations prioritized by risk
   • DIt avoids mentioning false positives to keep the report concise
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A CISO is deciding whether to conduct a vulnerability assessment or a penetration test. The goal is to identify as many potential weaknesses as possible in the environment. Which approach should the CISO choose?

   • ANeither, because these activities are not useful for identifying weaknesses.
   • BVulnerability assessment, because it is broader and identifies more potential weaknesses.
   • CBoth, but start with a penetration test to find exploitable issues.
   • DPenetration test, because it exploits vulnerabilities to prove impact.
   Reveal Solution Discussion Select an answer first