VAPT Strategy ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a large number of vulnerabilities identified in a recent assessment. The security team has limited resources and cannot fix all of them immediately. Management wants to reduce the overall risk as quickly as possible. What is the most effective strategy?

   • AFix vulnerabilities in the order they were discovered.
   • BWait for the next scheduled assessment to see if the vulnerabilities are still present.
   • CPrioritize vulnerabilities based on CVSS score and business impact, and fix the highest-risk ones first.
   • DFix only the vulnerabilities that are easy to fix, regardless of risk.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which VAPT framework is specifically focused on web application security and provides a testing guide that is widely used by penetration testers?

   • ANIST SP 800-115
   • BOWASP (Open Web Application Security Project) Testing Guide
   • CPTES (Penetration Testing Execution Standard)
   • DOSSTMM (Open Source Security Testing Methodology Manual)
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   During VAPT planning, what is the purpose of defining the testing window?

   • ATo limit the time that testers can work, ensuring they do not exceed their contracted hours
   • BTo ensure that testing is completed before the next software release
   • CTo schedule testing during periods of low business impact and to coordinate with change management processes
   • DTo allow testers to work overtime if needed
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security manager wants to identify all known vulnerabilities in a legacy internal application before a planned upgrade. The goal is to get a comprehensive list of weaknesses with severity ratings, not to validate whether any of them can be exploited. The testing must not disrupt the application. Which type of assessment should be performed?

   • AAn OSSTMM-based security audit that includes social engineering tests.
   • BA vulnerability assessment using an authenticated scanner with a non-intrusive plugin set.
   • CA penetration test using the PTES methodology with active exploitation attempts.
   • DA manual code review of the application source code to identify logic flaws.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A team wants to add automated security testing to their CI/CD pipeline. They need to catch common web vulnerabilities in each build without slowing down the pipeline, and they want the results to be available to developers in the pull-request view. Which integration should they implement?

   • ASchedule a full DAST scan against the production environment once a week and email the report to the security team.
   • BAdd a SAST tool as a pipeline stage that runs on every commit and posts findings as comments on the pull request.
   • CRun an interactive application security test (IAST) agent only in the staging environment after deployment.
   • DUse a vulnerability scanner to scan the container image after it is pushed to the registry, and store the report in the artifact repository.
   Reveal Solution Discussion Select an answer first