Security Assessment and Testing GISP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An organization is subject to a regulation that requires annual security audits. The internal audit team has found several control deficiencies, but the organization has already started remediation. The external auditor is due to issue a report next month. What should the organization do?

   • AReport only the remediated controls and omit the deficiencies to present a better compliance posture.
   • BAsk the external auditor to ignore the deficiencies because remediation is in progress.
   • CDelay the external audit until all remediation is complete.
   • DDocument the remediation progress and provide evidence of the controls that are now in place, while acknowledging the deficiencies that remain.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A penetration test report includes a critical finding that was successfully exploited, a high finding that could not be exploited due to time constraints, and several medium findings. Management wants to know which findings should be fixed first. What is the best recommendation?

   • AFix all medium findings first because they are easier to remediate quickly.
   • BFix only the critical finding, because it is the only one that was proven exploitable.
   • CAsk the penetration testers to re-test the high finding immediately before making any remediation decisions.
   • DPrioritize the critical finding, but also schedule the high finding for immediate investigation because it may be exploitable with more time.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of a vulnerability assessment?

   • ATo verify compliance with regulatory requirements only
   • BTo exploit vulnerabilities to demonstrate business impact
   • CTo replace the need for patch management
   • DTo identify, quantify, and prioritize vulnerabilities in systems and applications
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is asked to validate whether a newly deployed web application's authentication mechanism can be bypassed under real-world conditions. The organization has a strict change-management policy that prohibits any activity that could disrupt production systems, and the application is currently in active use by customers. The analyst must produce evidence of the actual exploitability of the authentication flaw, not just its presence. Which approach best satisfies the requirement?

   • APerform a manual penetration test in a staging replica of the application, attempting to exploit the authentication logic without affecting production.
   • BRun an authenticated vulnerability scanner against the application's login endpoint and report the CVSS score.
   • CReview the application's source code with a static analysis tool to identify the authentication flaw and document the code path.
   • DConduct a social engineering campaign against the application's users to obtain valid credentials and test the authentication bypass.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst has completed a vulnerability scan of the corporate network. The scanner reported 500 vulnerabilities, but the analyst knows that many are false positives or are in low-risk areas. What should the analyst do before reporting these findings to management?

   • AValidate the findings, filter out false positives, and prioritize the remaining vulnerabilities based on risk.
   • BDelete the findings that appear in low-risk areas to make the report look better.
   • CImmediately patch all 500 vulnerabilities without further analysis.
   • DReport all 500 findings exactly as the scanner output them, because the scanner is authoritative.
   Reveal Solution Discussion Select an answer first