VAPT Strategy ECDE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is a best practice when documenting VAPT findings?

   • AInclude only the vulnerabilities that were successfully exploited
   • BDelay the report until all vulnerabilities are fixed
   • CProvide a clear risk rating and remediation guidance for each vulnerability
   • DUse technical jargon to ensure only security experts can understand the report
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A DevSecOps engineer is responsible for managing vulnerabilities found in a CI/CD pipeline. The pipeline currently fails the build on any high-severity finding, which has caused frequent release delays because of false positives. The team wants to reduce delays while still ensuring that real high-severity vulnerabilities are not deployed. What should the engineer do?

   • AImplement a vulnerability management process that allows developers to mark findings as false positives with evidence, and require security review before the build can pass.
   • BDisable the vulnerability scanning step in the pipeline to avoid delays.
   • CChange the pipeline to fail only on critical findings, and allow all high-severity findings to be deployed.
   • DIncrease the severity threshold to critical and automatically create a ticket for high-severity findings without blocking the build.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In a CI/CD pipeline, at which stage is it most appropriate to run an automated vulnerability scan?

   • AAfter the code is deployed to production
   • BDuring the build and test stages, before deployment
   • COnly when a major release is scheduled
   • DOnly during the post-deployment monitoring phase
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When prioritizing vulnerabilities for remediation, which factor should be given the most weight?

   • AThe ease of exploitation and the potential impact on the business
   • BThe order in which the vulnerabilities were discovered
   • CThe number of systems affected
   • DThe cost of the remediation tool
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team has completed a penetration test and provided a report with several high-severity findings. The development team has applied fixes. What is the next step to ensure the fixes are effective?

   • AClose the findings without retesting because the developers say they fixed them.
   • BUpdate the vulnerability report and archive it without any further action.
   • CRun a full penetration test again from scratch to ensure no new vulnerabilities were introduced.
   • DConduct a retest of the specific vulnerabilities that were fixed, using the same or similar techniques as the original test.
   Reveal Solution Discussion Select an answer first