Security Assessment and Testing GISP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester needs to identify vulnerabilities in a custom web application that handles sensitive financial data. The tester has access to the application's source code and a staging instance. Which combination of techniques would provide the most comprehensive coverage?

   • APerform static analysis on the source code and dynamic testing against the staging instance, then manually verify any findings.
   • BRun a dynamic scan against the production instance to get the most realistic results.
   • CRun only a vulnerability scanner against the staging instance to identify known CVEs.
   • DReview the source code manually without executing the application.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A vulnerability assessment of a corporate network found 1,000 vulnerabilities. The security team has limited resources and must decide which to remediate first. The team has access to threat intelligence that indicates which vulnerabilities are being actively exploited in the wild. What is the most effective prioritization strategy?

   • APrioritize vulnerabilities that are both actively exploited and present on internet-facing systems, then address those with high CVSS scores.
   • BRemediate vulnerabilities in alphabetical order by system name to ensure fairness.
   • CRemediate only the vulnerabilities that are listed in the threat intelligence feed, because those are the most dangerous.
   • DRemediate all vulnerabilities with a CVSS score of 9.0 or higher, regardless of exposure or active exploitation.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A vulnerability scan of a network segment identifies a critical vulnerability in a legacy application that cannot be patched because the vendor is out of business. The application is used by the finance team and is not internet-facing. What should the security team do?

   • ADocument the risk, implement compensating controls such as network segmentation and strict access controls, and monitor the application closely.
   • BIgnore the vulnerability because the application is not internet-facing.
   • CAsk the finance team to stop using the application until a patch is available.
   • DRemove the application from the network immediately to eliminate the risk.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a recognized methodology for conducting penetration testing?

   • ATOGAF
   • BOWASP Testing Guide
   • CCOBIT 2019
   • DITIL Service Operation
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is asked to perform a penetration test on a new web application. The application is not yet in production, but the team has a limited time window before the go-live date. The team wants to identify as many exploitable vulnerabilities as possible. Which testing approach is most effective?

   • ACombine automated dynamic scanning with manual testing of business logic and authentication flows.
   • BWait until the application is in production to test it in the real environment.
   • CRun only automated vulnerability scanning tools to save time.
   • DPerform only manual testing because automated tools are unreliable.
   Reveal Solution Discussion Select an answer first