Security Testing GWEB Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security manager is planning a penetration test for a web application that is subject to PCI DSS. The test must be completed within a two-week window, and the budget is fixed. The manager must decide whether to use an external penetration testing firm or the internal security team. The internal team knows the application well but has limited time. The external firm is experienced but will need time to understand the application. Which factor is MOST important in this decision?

   • AThe cost of the external firm versus the internal team's hourly rate.
   • BThe internal team's familiarity with the application's codebase.
   • CThe ability to meet the PCI DSS requirement for an independent assessment.
   • DThe external firm's reputation in the industry.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is planning a security test for a web application that is being developed using an agile methodology. The team wants to integrate security testing into the CI/CD pipeline. The application is updated frequently, and the team wants to catch vulnerabilities early. Which approach best balances early detection with the risk of slowing down development?

   • ARun a full penetration test after every release.
   • BIntegrate automated vulnerability scanning into the CI/CD pipeline and perform manual penetration tests on major releases.
   • CPerform threat modeling once at the start of the project and rely on that.
   • DSkip security testing until the application is feature-complete.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company is planning a security test for its customer-facing web application. The compliance team requires that no production data be exposed to testers, but the test must validate the application's handling of sensitive customer data. The test window is limited to a weekend to avoid business disruption. Which approach best satisfies these constraints?

   • APerform a manual penetration test on a staging environment that contains synthetic but realistic customer data, with rules of engagement limiting testers to that environment.
   • BConduct a full penetration test on production with signed authorization, but restrict testers from accessing any customer records during the test.
   • CDeploy a temporary copy of production to a cloud environment and run automated scans without notifying the security team.
   • DRun an automated vulnerability scan against the production environment during the weekend, using only non-destructive scan profiles.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A penetration test has concluded, and the tester must write a report for both technical staff and management. Which structure is most effective?

   • AProvide only the executive summary to all stakeholders.
   • BInclude an executive summary with business impact and a separate technical appendix with detailed findings.
   • CWrite a single technical report with all details for both audiences.
   • DSend the raw scan output to all stakeholders.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application team is about to begin a security assessment of a customer-facing e-commerce portal. The compliance officer insists that the assessment must not disrupt production traffic, and the legal team requires a formal document that defines the scope, authorized testing windows, and emergency contacts. Which action should the team take FIRST?

   • ARun an authenticated vulnerability scan against the production environment during off-peak hours.
   • BAsk the development team for a list of all third-party libraries so the scan can be limited to known vulnerable components.
   • CPerform a threat model to identify the highest-risk components and then immediately test those components.
   • DDraft and obtain sign-off on a rules of engagement document that includes scope, timing, and contacts.
   Reveal Solution Discussion Select an answer first