Security Testing GWEB Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a security test report?

   • ATo replace the need for further security testing
   • BTo document findings and provide actionable recommendations for remediation
   • CTo serve as a legal document for prosecution of attackers
   • DTo provide a detailed log of all user activities during the test
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A penetration tester is assessing a web application that uses a Web Application Firewall (WAF). The tester wants to bypass the WAF to test the underlying application. Which approach is most effective?

   • AUse encoding variations and payload obfuscation techniques to evade WAF rules.
   • BRun a standard vulnerability scanner and assume the WAF will not interfere.
   • COnly test from a whitelisted IP address to avoid WAF blocking.
   • DDisable the WAF temporarily to test the application directly.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which activity is typically performed during the 'exploitation' phase of a penetration test?

   • AWriting a detailed report of the findings
   • BRemediating the vulnerabilities found
   • CDefining the scope and rules of engagement
   • DAttempting to gain unauthorized access by exploiting a discovered vulnerability
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is planning a penetration test for a web application that is hosted in a cloud environment. The application is business-critical and has a strict SLA. The team must balance thorough testing with the risk of disrupting operations. Which approach best addresses this constraint?

   • APerform all testing in production during business hours to get realistic results.
   • BLimit testing to passive techniques that do not send any traffic to the application.
   • CSkip the penetration test and rely on automated scanning only.
   • DUse a staging environment that mirrors production and schedule any production testing during approved maintenance windows.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security architect is threat modeling a new web application that will handle sensitive financial data. The team has limited time and budget. The architect must choose between a full STRIDE analysis and a focused attack-tree analysis. The application has a complex authentication flow and a simple data storage design. Which approach is more appropriate?

   • AFocused attack-tree analysis on the authentication flow because it is the most complex and high-risk component.
   • BSkip threat modeling and go straight to penetration testing.
   • CUse only automated threat modeling tools to save time.
   • DFull STRIDE analysis because it covers all threat categories comprehensively.
   Reveal Solution Discussion Select an answer first