Security Assessment and Testing GISP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An internal audit reveals that several servers are missing required security patches, and the audit report is due to the board next week. The IT team has limited staff to apply patches. What should the team do first?

   • APrioritize patching the servers that are internet-facing or contain sensitive data, and document the risk for the remaining servers.
   • BAsk the auditor to remove the missing patches from the report because the team is working on them.
   • CDelay the audit report until all patches are applied, even if it takes several months.
   • DPatch all servers in alphabetical order to ensure every server is treated equally.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key element of effectively communicating assessment findings to stakeholders?

   • ASharing raw vulnerability scan logs with all stakeholders
   • BOnly reporting successful exploits and ignoring other findings
   • CDelaying the report until all vulnerabilities are fixed
   • DPresenting findings in a clear, risk-based format tailored to the audience
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to determine whether an attacker could chain a known web application flaw with a misconfigured firewall to reach an internal database. The team has already run a vulnerability scanner that identified the flaw and the misconfiguration. Which activity should the team perform next to meet this objective?

   • ARe-run the vulnerability scanner with a more aggressive plugin set to confirm the findings.
   • BConduct a penetration test that attempts to exploit the flaw and pivot through the firewall to the database.
   • CPerform a configuration review of the firewall to ensure the rule is documented.
   • DInterview the database administrator to ask whether the database is accessible from the web application.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team must test a critical web application that is currently in production. The application cannot be taken offline, and the team has a very limited testing window. The team wants to identify as many vulnerabilities as possible without causing disruption. Which testing strategy is most appropriate?

   • ARun a full penetration test against production with a wide scope to maximize coverage.
   • BPerform only static analysis on the source code, because it does not affect production.
   • CRun a combination of authenticated and unauthenticated dynamic scans against a staging copy of the application, then manually verify the highest-risk findings.
   • DRun a vulnerability scanner against production with all plugins enabled to get the most comprehensive results.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security manager is planning the annual assessment program for the organization. The organization must meet a regulatory requirement for an annual independent evaluation of its security controls, and the manager also wants to identify exploitable weaknesses in the organization's external-facing systems. The budget allows for only one external assessment activity. Which type of assessment should the manager select to satisfy both the regulatory requirement and the operational need?

   • AA security audit that evaluates controls against the regulatory standard and includes a review of external system configurations.
   • BA penetration test that attempts to exploit vulnerabilities in the external-facing systems.
   • CA vulnerability assessment that scans external systems and reports on known vulnerabilities.
   • DA risk assessment that evaluates the likelihood and impact of potential threats to external systems.
   Reveal Solution Discussion Select an answer first