Vulnerability Scanning and Penetration Testing GSEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of a vulnerability scan?

   • ATo identify and report potential security weaknesses in systems and applications
   • BTo verify that all security patches are up to date
   • CTo measure the overall security posture of an organization against industry standards
   • DTo actively exploit discovered weaknesses to prove impact
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A quarterly vulnerability scan of a web application reports a critical SQL injection vulnerability in a legacy login module. The module is scheduled for replacement in six months, and the application is internet-facing. The security team has limited resources. What is the most appropriate immediate action?

   • ASchedule the module replacement for the next maintenance window.
   • BRe-run the scan with higher intensity to confirm the finding.
   • CImplement a web application firewall rule to mitigate the SQL injection pattern while the module is being replaced.
   • DDisable the legacy login module until the replacement is complete.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A vulnerability scan report lists a critical-severity vulnerability on a server that is not exposed to the internet and is only accessible from a trusted internal network. How should this finding be prioritized?

   • ATreat it as the highest priority because it is critical severity
   • BIgnore the finding because the server is internal
   • CDefer remediation until the next scheduled maintenance window
   • DConsider the exposure and exploitability in the internal network context before assigning priority
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which type of vulnerability scan focuses on identifying vulnerabilities in web applications, such as SQL injection and cross-site scripting?

   • AApplication scan
   • BPort scan
   • CNetwork scan
   • DHost scan
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester has completed the exploitation phase and gained access to a test environment. Before proceeding to post-exploitation, what is the most important action to take?

   • ANotify the client and ask for permission to continue.
   • BImmediately document the exploitation method and move to reporting.
   • CReview the scope and rules of engagement to confirm that post-exploitation activities are authorized.
   • DErase all logs to avoid detection.
   Reveal Solution Discussion Select an answer first