Hide Vulnerability CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester finds two vulnerabilities in a client's environment: (1) a critical SQL injection in a public-facing web application that could lead to full database compromise, and (2) a medium-severity misconfiguration in an internal server that exposes sensitive documents to authenticated users. The client has limited resources and can only fix one issue this quarter. How should the tester advise the client to prioritize?

   • AFix the SQL injection first because it has a higher CVSS score and is externally exploitable, posing a greater risk to the organization.
   • BFix the internal misconfiguration first because it is easier and quicker to resolve, freeing up resources for the larger issue later.
   • CRecommend not fixing either issue and instead purchasing additional cyber insurance.
   • DAdvise the client to fix both simultaneously, even if it means delaying other projects.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key element of effective vulnerability documentation?

   • AOmitting the affected systems to keep the report short
   • BUsing only technical jargon to show expertise
   • CIncluding the tester's personal opinions about the vendor
   • DIncluding steps to reproduce the vulnerability
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of reporting a discovered vulnerability in a structured and responsible manner?

   • ATo publicly demonstrate the tester's technical skill and expertise
   • BTo create a legal record that can be used in future litigation against the organization
   • CTo enable the affected organization to understand, prioritize, and remediate the risk effectively
   • DTo sell the vulnerability details to the highest bidder before informing the vendor
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team needs to report a critical vulnerability to the company's board of directors. The board is concerned about financial and reputational impact. What is the most appropriate way to structure the report for this audience?

   • AA short email stating that a 'critical issue' was found and that the IT department is handling it.
   • BA high-level executive summary focusing on potential business impact, likelihood of exploitation, and recommended actions, with technical details in an appendix.
   • CA detailed technical write-up including the exact exploit code, affected functions, and patch recommendations.
   • DA copy of the raw vulnerability scan report from the automated scanner.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester discovers a vulnerability in a client's web application that allows an unauthenticated attacker to read the contents of any file on the server, including configuration files with database credentials. The tester needs to communicate this finding to the client's IT manager, who is not deeply technical. What is the most effective way to convey the severity and urgency?

   • AProvide the raw HTTP request and response that demonstrates the vulnerability, and let the IT manager decide on the next steps.
   • BExplain that the vulnerability is a 'high-severity path traversal' issue and recommend applying the vendor's latest patch.
   • CDescribe the risk in business terms: an attacker could steal customer data and database credentials, leading to a data breach, and recommend immediate mitigation such as input validation and patching.
   • DState that the application is 'hackable' and needs to be rewritten from scratch.
   Reveal Solution Discussion Select an answer first