Security Testing GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A vulnerability scanner has flagged a potential file inclusion vulnerability in a web application. The application is legacy and the code is not well documented. What is the most appropriate next step?

   • ARun the scanner again with a different tool to see if it agrees.
   • BManually review the relevant code and test the parameter with various payloads to confirm the vulnerability.
   • CIgnore the finding because the application is legacy and not critical.
   • DImmediately take the application offline to prevent exploitation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of defining 'rules of engagement' in a security test plan?

   • ATo specify the boundaries and constraints of the testing activities
   • BTo describe the application's business logic
   • CTo provide a step-by-step guide for exploiting vulnerabilities
   • DTo list all the vulnerabilities found during the test
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is planning a penetration test for a web application that is hosted in a cloud environment. The test must not affect other tenants sharing the same infrastructure. Which constraint is most important to include in the rules of engagement?

   • AAllow the test to use any tools necessary, including those that might affect the underlying infrastructure.
   • BLimit the test to the application's own resources and avoid any actions that could impact shared infrastructure.
   • CEnsure the testers have administrative access to the cloud account.
   • DRequire the test to be conducted only during business hours.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration test has identified a critical vulnerability in a web application. The development team wants to fix it immediately, but the security team wants to document the finding first. Which approach is most appropriate?

   • ADocument the vulnerability with enough detail to reproduce it, then work with the team to remediate.
   • BOnly document the vulnerability after the fix is deployed.
   • CKeep the vulnerability secret until the report is finalized.
   • DAllow the development team to fix the vulnerability immediately and update the report later.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After completing a web application security assessment, a tester has a list of findings that includes a critical SQL injection, a medium-severity XSS, and a low-severity information disclosure in an error page. The report must be useful to both executives and developers. How should the tester present the findings?

   • ASend the raw scanner output to the development team and a summary to executives.
   • BList only the critical finding in the report to avoid overwhelming the audience.
   • CWrite an executive summary with risk ratings and business impact, and a separate technical annex with reproduction steps and remediation.
   • DProvide a single technical report with all details, assuming the audience is technical.
   Reveal Solution Discussion Select an answer first