Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A CISO wants to validate that the organization's security controls can detect and respond to a real attack. The CISO is considering a penetration test. What is the primary objective of this penetration test?

   • ATo exploit vulnerabilities and demonstrate the impact of a real attack.
   • BTo comply with regulatory requirements.
   • CTo patch all identified vulnerabilities.
   • DTo identify as many vulnerabilities as possible.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary goal of the analysis phase in a vulnerability assessment?

   • ATo install patches on vulnerable systems
   • BTo exploit identified vulnerabilities to gain access
   • CTo determine the scope of the assessment
   • DTo validate scan results and eliminate false positives
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is using a vulnerability scanner to assess a network. The scanner reports a vulnerability with a CVSS score of 7.5. The analyst needs to determine if this vulnerability is actually exploitable in the environment. What should the analyst do?

   • ACheck the vulnerability database for the publication date.
   • BManually verify the vulnerability by attempting to exploit it.
   • CTrust the CVSS score and remediate immediately.
   • DIgnore the finding because the score is not critical.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration testing team has completed the reconnaissance and scanning phases for a client engagement. During scanning, they identified a web application that appears to use a custom session token. The team now needs to determine whether the token is predictable and whether an attacker could hijack an active session. According to the PTES methodology, which phase should the team execute next to answer this question?

   • AReporting, by documenting the session token weakness as a finding even though no access was gained, since the token pattern is clearly weak.
   • BExploitation, by attempting to brute-force the session token and then using a valid token to access another user's account.
   • CPost-exploitation, by maintaining access to the application and demonstrating the business impact of session hijacking on the client's data.
   • DReconnaissance, by gathering more information about the application framework and session token generation algorithm from public sources.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A multinational corporation is planning a penetration test of its global e-commerce platform. The platform is hosted in multiple regions and processes payment card data. The CISO must choose a methodology that provides a structured, measurable approach to security testing and is recognized by auditors. The test will include both network and application layers, and the team needs clear phases from pre-engagement through reporting. Which methodology is the best fit?

   • ANIST SP 800-115, because it is a U.S. government standard that is mandatory for all commercial penetration tests.
   • BOWASP Testing Guide, because it is the definitive standard for web application testing and covers all layers of the e-commerce platform.
   • COSSTMM, because it focuses on operational security metrics and channel-based testing that can be measured and compared across regions.
   • DPTES, because it provides a detailed, phase-based framework covering pre-engagement, intelligence gathering, threat modeling, exploitation, post-exploitation, and reporting.
   Reveal Solution Discussion Select an answer first