Vulnerability Assessments and Penetration Testing CCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A CISO is planning a penetration test of a critical financial application. The test must validate the effectiveness of the WAF and the SIEM alerting, but the organization cannot afford a full black-box test. The CISO also wants to minimize the risk of the test causing a production outage. Which testing approach best meets these requirements?

   • AUse an external scanning tool to identify vulnerabilities without active exploitation.
   • BRun a gray-box test with limited knowledge, focusing on WAF bypass techniques and monitoring SIEM alerts.
   • CConduct a black-box test from the internet to simulate a real attacker.
   • DPerform a white-box test with full knowledge of the application and infrastructure.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which tool is primarily used for web application penetration testing?

   • AMetasploit
   • BJohn the Ripper
   • CWireshark
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A CISO is planning the annual security testing program. The organization has a mature vulnerability management program that includes monthly scans and quarterly patch cycles. The CISO wants to add an activity that validates whether the existing security controls can be bypassed. The budget is limited, and the CISO must choose between a full penetration test and a targeted red-team exercise. What is the most important factor in this decision?

   • AThe scope: a red-team exercise is always broader than a penetration test, so it is the better choice for validating technical controls.
   • BThe reporting: a penetration test produces a detailed technical report, while a red-team exercise produces only an executive summary.
   • CThe specific objective: a penetration test validates technical controls, while a red-team exercise tests the organization's overall detection and response capabilities.
   • DThe cost: a penetration test is always more expensive than a red-team exercise, so the CISO should choose the red team to save money.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A CISO at a financial services firm wants to run a penetration test against the company's production trading application. The test will be performed by an external contractor. The contractor has proposed testing during normal business hours to observe real user behavior. The CISO is concerned about potential service disruption and regulatory notification requirements. What should the CISO do before the test begins?

   • ASign a detailed rules of engagement document that defines the testing window, allowed techniques, emergency stop procedures, and regulatory notification responsibilities.
   • BRely on the contractor's professional judgment to avoid disruption and to notify regulators if they believe it is necessary.
   • CInstruct the contractor to test only during off-hours without documenting the schedule, to avoid alerting the security operations center.
   • DRequire the contractor to sign a non-disclosure agreement and begin testing immediately to minimize the window of exposure.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the most important legal requirement before conducting a penetration test against an organization's systems?

   • AObtaining written authorization from the organization
   • BNotifying law enforcement agencies
   • CObtaining a certification in penetration testing
   • DPurchasing a commercial penetration testing tool
   Reveal Solution Discussion Select an answer first