VAPT Strategy ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vulnerability assessment identified a critical remote code execution vulnerability in a web server. The team applied a patch. What is the best way to verify that the patch is effective?

   • ARun a full penetration test on the entire network.
   • BRe-run the vulnerability scanner against the web server to confirm the vulnerability is no longer detected.
   • CCheck the patch installation log and assume it is fixed.
   • DWait for the next scheduled vulnerability assessment to see if it is still there.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is planning a penetration test for its production environment. The test must not cause any service disruption, and the scope must be clearly defined to avoid testing third-party hosted services. Which action is most important to include in the planning phase?

   • ASelect the latest penetration testing tools and run them with default configurations.
   • BAsk the development team to provide all source code and credentials to the testers.
   • CSchedule the test during peak business hours to ensure maximum coverage.
   • DDefine the exact IP ranges, domains, and testing windows, and obtain written authorization from all asset owners.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key characteristic of the PTES (Penetration Testing Execution Standard) framework?

   • AIt is a tool that automates the entire penetration testing process
   • BIt focuses exclusively on mobile application security testing
   • CIt provides a structured methodology that includes phases such as pre-engagement interactions, intelligence gathering, and reporting
   • DIt is a compliance standard that mandates specific security controls
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team needs to test a network for vulnerabilities. They have a limited budget and need to cover a large number of systems. They also need to produce a report that can be used to prioritize remediation. Which tool or approach is most cost-effective?

   • ARun a manual penetration test on a sample of systems and extrapolate the results.
   • BUse an open-source vulnerability scanner like OpenVAS to scan the entire network and generate a prioritized report.
   • CHire an external penetration testing firm to manually test every system.
   • DUse a commercial vulnerability scanner that requires a high license fee.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is about to launch a new public-facing web application. The security team wants to run a penetration test before launch, but the application is still in a staging environment that is not accessible from the internet. The test must cover the application's authentication and authorization logic. What should the engineer do?

   • AWait until the application is deployed to production and then run the test against the public URL.
   • BExpose the staging environment to the internet temporarily so the test can be run from an external perspective.
   • CPerform only a static code review of the authentication and authorization code instead of a penetration test.
   • DRun the penetration test from the internal network against the staging environment, with the scope limited to the application's authentication and authorization functions.
   Reveal Solution Discussion Select an answer first