VAPT Strategy ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is planning a penetration test for a critical infrastructure system. The system is regulated, and the test must not impact availability. The team has a limited testing window and needs to produce a report that satisfies the regulator. Which methodology should they use?

   • AOSSTMM, because it provides a comprehensive security audit framework that includes operational and human factors.
   • BOWASP Testing Guide, because it is the industry standard for web applications.
   • CPTES, because it includes a detailed rules-of-engagement phase that can define the no-impact constraint and a structured reporting phase.
   • DNIST SP 800-115, because it is a government standard that regulators always accept.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following tools is commonly used for manual web application penetration testing?

   • AMetasploit
   • BBurp Suite
   • CNmap
   • DWireshark
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes the scope of a penetration test compared to a vulnerability assessment?

   • APenetration testing is limited to network-level testing, while vulnerability assessment covers applications
   • BPenetration testing is more focused and deeper, while vulnerability assessment is broader and shallower
   • CPenetration testing is automated, while vulnerability assessment is manual
   • DPenetration testing covers a wider range of systems than vulnerability assessment
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the context of the release and deploy stage, what is the primary purpose of a VAPT strategy?

   • ATo ensure that the application is free of all possible security vulnerabilities before release
   • BTo replace the need for code review and static analysis by performing dynamic testing only
   • CTo satisfy compliance requirements without affecting the release timeline
   • DTo systematically identify, assess, and validate security weaknesses in the application before it is deployed to production
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A penetration tester is assigned to test a web application that uses both REST APIs and a GraphQL endpoint. The tester needs a methodology that provides detailed guidance for testing GraphQL-specific vulnerabilities. Which framework should the tester consult?

   • AThe NIST SP 800-115, which includes a dedicated GraphQL testing checklist.
   • BThe OWASP Testing Guide, which includes a section on GraphQL API testing.
   • CThe PTES technical guidelines, which focus exclusively on network-layer testing.
   • DThe OSSTMM manual, which provides detailed GraphQL attack payloads.
   Reveal Solution Discussion Select an answer first