VAPT Strategy ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team has a limited budget and needs to assess a new web application before launch. The application is internet-facing and handles sensitive user data. The team wants to identify exploitable vulnerabilities that could lead to data breach, but they also need to produce a report that demonstrates due diligence to regulators. Which assessment approach should they choose?

   • AA security audit using the OSSTMM framework, because it covers operational and human factors.
   • BA source code review using a SAST tool, because it is fast and can be integrated into the CI/CD pipeline.
   • CA vulnerability assessment using an automated scanner, because it is cost-effective and produces a comprehensive report of known vulnerabilities.
   • DA penetration test using the PTES methodology, because it validates exploitability and provides a structured report that demonstrates due diligence.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the main benefit of integrating vulnerability scanning into a CI/CD pipeline?

   • AIt eliminates the need for manual penetration testing
   • BIt guarantees that no vulnerabilities will be present in the final release
   • CIt provides continuous security feedback during the development process, allowing early detection of vulnerabilities
   • DIt speeds up the release process by removing the need for security reviews
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After a penetration test, the security team has a list of findings. Management wants to know which vulnerabilities to fix first. The team has identified a critical SQL injection in the main application, a medium-severity misconfiguration in a non-critical internal tool, and a low-severity information disclosure in an error page. What should the team do?

   • AOnly fix the low-severity issues because they are easier to resolve.
   • BFix all vulnerabilities in the order they were discovered, regardless of severity.
   • CPrioritize remediation based on risk (likelihood and impact), starting with the critical SQL injection, and then retest after fixes.
   • DReport the findings but do not fix anything until the next scheduled penetration test.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a critical element to include in the scope definition of a VAPT engagement?

   • AThe list of in-scope IP addresses, domains, and application endpoints
   • BThe total budget allocated for the testing engagement
   • CThe names of the individual testers and their certifications
   • DThe expected number of vulnerabilities to be found
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A DevSecOps team wants to add automated security testing to their CI/CD pipeline for a web application. They need to catch common web vulnerabilities (e.g., SQLi, XSS) in each build without slowing down the pipeline significantly. They also want to run a deeper manual-style test only on release candidates. Which approach best meets these requirements?

   • ARun a SAST scanner only on the main branch and skip dynamic testing until after deployment to production.
   • BUse a vulnerability scanner (e.g., Nessus) on the built container image and rely on that for all security testing.
   • CRun a DAST scanner (e.g., OWASP ZAP) in the pipeline on every build, and schedule a full PTES-based manual penetration test on release candidates.
   • DPerform a full manual penetration test on every commit to ensure thorough coverage.
   Reveal Solution Discussion Select an answer first