Penetration Testing Fundamentals ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is asked to assess the security of a financial application. The client wants to know if an attacker could steal funds or manipulate transactions. The tester has access to the application's source code and a test environment. Which type of testing would be most appropriate to answer the client's question?

   • AA security audit to ensure compliance with financial regulations.
   • BA vulnerability assessment to identify potential weaknesses.
   • CA penetration test that attempts to exploit vulnerabilities to achieve specific business impacts.
   • DA code review to find coding errors.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration testing contract specifies that the test must be conducted only between 2:00 AM and 6:00 AM on weekends to avoid impacting business operations. The tester discovers that a critical vulnerability can only be fully exploited during business hours when the application is under peak load. What should the tester do?

   • AAsk the client to waive the time restriction for this specific test.
   • BProceed with testing during business hours to get accurate results, then report the deviation.
   • CCancel the test because the rules of engagement are too restrictive.
   • DTest during the allowed hours and document the limitation in the final report.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has a mature vulnerability management program that includes regular automated scans and patch management. They are now considering a penetration test. The security manager argues that the scans already identify vulnerabilities, so a penetration test is redundant. Which argument best justifies the need for a penetration test?

   • APenetration testing will find more vulnerabilities than the scans.
   • BPenetration testing validates the real-world exploitability of vulnerabilities and identifies chains of weaknesses that scans cannot.
   • CPenetration testing is cheaper than running regular scans.
   • DPenetration testing is required by law, so the company must do it.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company wants to assess its external web application for known vulnerabilities before a scheduled PCI DSS audit. The security team has limited time and budget and needs a report listing missing patches, misconfigurations, and outdated components with severity ratings. Which approach best meets this requirement?

   • AConduct a full penetration test that includes exploitation of identified vulnerabilities to demonstrate business impact.
   • BRun a vulnerability assessment that scans for known vulnerabilities and produces a prioritized list of findings.
   • CDeploy an intrusion detection system to monitor traffic and alert on known attack patterns.
   • DPerform a manual code review of the application source code to find logic flaws and business logic errors.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In black-box penetration testing, what level of information is provided to the tester?

   • ANo prior knowledge of the target's internal structure or credentials
   • BFull knowledge of the source code, architecture, and credentials
   • COnly the IP address of the target server
   • DPartial knowledge, such as network diagrams but not credentials
   Reveal Solution Discussion Select an answer first