Penetration Testing Fundamentals ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is considering hiring a penetration tester to evaluate their security. The CEO asks, 'What will we get from this that we don't already get from our quarterly vulnerability scans?' Which response best describes the unique value of a penetration test?

   • AA penetration test validates whether vulnerabilities can be exploited and demonstrates the real business impact.
   • BA penetration test is required by all compliance frameworks.
   • CA penetration test provides a more comprehensive list of vulnerabilities than any scanner can.
   • DA penetration test eliminates all security risks.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   During a penetration test, a tester successfully exploits a vulnerability and gains access to a database containing customer records. The tester then extracts a sample of records to demonstrate the impact. Which phase of the penetration test does this activity fall under, and what is the primary purpose?

   • AReporting, to include the data in the final report.
   • BReconnaissance, to gather information about the database.
   • CExploitation, to prove that the vulnerability is real.
   • DPost-exploitation, to demonstrate the business impact of the compromise.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which statement best describes the purpose of penetration testing?

   • ATo replace the need for regular security audits and risk assessments
   • BTo simulate an attacker's actions to uncover exploitable weaknesses and assess the impact of a breach
   • CTo prove that a system is secure by showing no vulnerabilities exist
   • DTo automatically fix all identified security issues without human intervention
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   During a penetration test, the tester has completed the reconnaissance and scanning phases and has identified a potential vulnerability in a web application. The tester now needs to confirm the vulnerability and determine its exploitability. Which phase of the penetration test is the tester about to enter?

   • AExploitation
   • BReconnaissance
   • CReporting
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A healthcare organization wants to validate that its new patient portal is secure against real-world attacks before launch. The compliance team requires a formal assessment that demonstrates whether identified vulnerabilities can be exploited to access patient data. The budget is limited, and the portal is already scheduled for a vulnerability scan. What should the organization do to meet the compliance requirement without duplicating effort?

   • AConduct a code review of the portal and skip the vulnerability scan.
   • BRun the vulnerability scan and use its results as the final compliance evidence.
   • CDeploy a web application firewall and consider the portal secure.
   • DPerform a penetration test that builds on the vulnerability scan results to attempt exploitation of high-risk findings.
   Reveal Solution Discussion Select an answer first