VAPT Strategy ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration test has been completed, and the report contains a critical finding with a proof-of-concept exploit. The development team asks for the raw exploit code to reproduce the issue. What should the DevSecOps engineer do?

   • AInclude the exploit code in the final report but do not provide any remediation guidance.
   • BRefuse to share the exploit code and only provide the vulnerability description and remediation steps.
   • CProvide the exploit code along with the report, but require that it be used only in the staging environment and deleted after verification.
   • DShare the exploit code publicly in the issue tracker so all developers can see it.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is planning the first VAPT engagement for a new customer-facing web portal. Management wants a broad, automated check for known vulnerabilities across the entire infrastructure, but also wants to know if a real attacker could chain vulnerabilities to gain unauthorized access to customer data. The budget allows for one engagement. What should the team do?

   • AConduct only a penetration test on the web application, assuming the infrastructure is secure.
   • BHire an external penetration testing firm to test only the customer database directly.
   • CPerform only a vulnerability scan and report the findings without attempting exploitation.
   • DRun an automated vulnerability scan across all assets and then perform a focused penetration test on the highest-risk findings to validate exploitability.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best describes the role of VAPT in a DevSecOps release pipeline?

   • AIt is a continuous security validation activity that identifies and helps remediate vulnerabilities before and during deployment
   • BIt is primarily focused on compliance reporting rather than technical security improvement
   • CIt is a one-time activity performed just before the final production release
   • DIt is a manual process that requires dedicated security experts for every build
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A penetration test report contains a finding that was verified as a false positive by the development team. The security team disagrees and believes it is a real vulnerability. The report is due to be submitted to the compliance team next week. What should the DevSecOps engineer do?

   • ASubmit the report without the finding and add a note that the development team disputed it.
   • BRe-test the finding with the development team present, document the evidence and the outcome, and include both perspectives in the final report.
   • CRemove the finding from the report because the development team says it is a false positive.
   • DKeep the finding in the report as a confirmed vulnerability, ignoring the development team's analysis.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration testing team is asked to test a web application that is hosted in a cloud environment. The team is not familiar with the cloud provider's specific services. They need a methodology that will help them understand the application's architecture and identify potential attack vectors. Which approach is most effective?

   • AUse OSSTMM because it is the only framework that covers cloud environments.
   • BSkip the methodology and rely on automated scanning tools.
   • CUse the OWASP Testing Guide and adapt it to the cloud environment by mapping the application's components to cloud services.
   • DUse a cloud-specific penetration testing framework that is not widely known.
   Reveal Solution Discussion Select an answer first