Security Assessment and Testing GISP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a typical output of a security audit?

   • AA list of exploited systems and compromised data
   • BA report detailing compliance status and identified gaps
   • CA new set of security policies
   • DA real-time alert feed of security incidents
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a vulnerability assessment, what does 'prioritizing' vulnerabilities typically involve?

   • ADeleting vulnerabilities that are not easily exploitable
   • BRanking vulnerabilities based on risk, such as severity and exploitability
   • CListing vulnerabilities alphabetically for easier reference
   • DAssigning vulnerabilities to the first available technician
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has a budget to test only 5 of 20 systems this year. The systems include a public web server, an internal file server, a development database, a legacy application used by a small team, and a new cloud-based customer relationship management (CRM) system. Which systems should be tested first?

   • AThe legacy application and the internal file server, because they are older and likely have more vulnerabilities.
   • BThe development database and the legacy application, because they are not business-critical and can be tested with less disruption.
   • CThe internal file server and the development database, because they are easier to test without external dependencies.
   • DThe public web server and the cloud-based CRM system, because they are externally accessible and contain sensitive data.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In risk-based testing, which factor is typically considered when prioritizing a test area?

   • AThe order in which features were developed
   • BThe number of lines of code in the module
   • CThe potential business impact if the area is compromised
   • DThe age of the developer who wrote the code
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a vulnerability assessment, the security team has a list of 200 findings. Management wants a report that clearly shows which vulnerabilities pose the greatest risk to the organization and what actions are needed. What is the most effective way to present this information?

   • AProvide a raw export of all 200 findings sorted by the date they were discovered.
   • BProvide a detailed technical report with every vulnerability's CVSS vector and proof-of-concept code.
   • CProvide a prioritized findings list with risk ratings, recommended remediation actions, and assigned owners.
   • DProvide a summary that lists only the vulnerabilities that have a known public exploit.
   Reveal Solution Discussion Select an answer first