A penetration test is being planned for a healthcare organization that must comply with HIPAA. The test will involve scanning systems that contain protected health information (PHI). What is the most critical consideration?

Obtain verbal approval from the system owner before the test.

Ensure the rules of engagement specify how PHI will be handled and that the testers are bound by confidentiality agreements.

Exclude all systems containing PHI from the test.

Use only passive scanning techniques to avoid any impact on PHI.

A security team is planning a vulnerability scan of a large enterprise network that includes both internal servers and public-facing web applications. The team wants to minimize the risk of disrupting production services while still obtaining comprehensive coverage. The scan must be completed within a maintenance window of 4 hours. Which approach best balances these constraints?

Run a single unauthenticated network scan of all hosts with maximum intensity

Run an authenticated scan of internal hosts with a low-intensity profile and a separate application scan of web applications

Run only an application scan of the public-facing web applications

Run a host scan of internal servers without credentials and skip web applications

A company is about to launch a new customer-facing web application. The security team wants to identify common web vulnerabilities before launch. The application is hosted in a cloud environment and uses a mix of third-party and custom components. What is the most appropriate scan type?

Unauthenticated network scan of the public IP range.

Network scan of the hosting environment.

Application scan targeting the web application's functionality.

Host scan of the underlying servers.

GIAC Security Essentials

Domain 5Objective 4

Vulnerability Scanning and Penetration Testing GSEC Practice Questions (Page 5)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 21–25

21expert · hard
A penetration test is being planned for a healthcare organization that must comply with HIPAA. The test will involve scanning systems that contain protected health information (PHI). What is the most critical consideration?
Select an answer first
22application · medium
A security manager wants to identify as many potential vulnerabilities as possible in a short time, without actively exploiting them. The goal is to get a baseline of the organization's security posture. Which activity should the manager choose?
Select an answer first
23expert · hard
A security team is planning a vulnerability scan of a large enterprise network that includes both internal servers and public-facing web applications. The team wants to minimize the risk of disrupting production services while still obtaining comprehensive coverage. The scan must be completed within a maintenance window of 4 hours. Which approach best balances these constraints?
Select an answer first
24application · medium
A company is about to launch a new customer-facing web application. The security team wants to identify common web vulnerabilities before launch. The application is hosted in a cloud environment and uses a mix of third-party and custom components. What is the most appropriate scan type?
Select an answer first
25application · medium
A company wants to test its incident response capabilities by simulating a realistic attack. The test should not be limited to a specific system or vulnerability, and the attackers should have no prior knowledge of the environment. What type of test should the company conduct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Vulnerability Scanning and Penetration Testing GSEC Practice Questions (Page 5)

Questions 21–25

A penetration test is being planned for a healthcare organization that must comply with HIPAA. The test will involve scanning systems that contain protected health information (PHI). What is the most critical consideration?

A security manager wants to identify as many potential vulnerabilities as possible in a short time, without actively exploiting them. The goal is to get a baseline of the organization's security posture. Which activity should the manager choose?

A company is about to launch a new customer-facing web application. The security team wants to identify common web vulnerabilities before launch. The application is hosted in a cloud environment and uses a mix of third-party and custom components. What is the most appropriate scan type?

A company wants to test its incident response capabilities by simulating a realistic attack. The test should not be limited to a specific system or vulnerability, and the attackers should have no prior knowledge of the environment. What type of test should the company conduct?

Keep studying — Security Operations and Incident Response