CAP Vulnerability Assessment & Penetration Testing 2 — Questions and Answers
Question 1: During a penetration test, a tester discovers that a web application reflects user input directly in HTTP responses without encoding. Which vulnerability class does this represent?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- Command Injection
- Path Traversal
Correct answer: Cross-Site Scripting (XSS)
Reflected XSS occurs when unsanitized user input is echoed back in HTTP responses, allowing script injection in the victim's browser.
Question 2: Which NIST publication provides the primary framework for conducting security assessments and authorizations under the RMF?
- NIST SP 800-53
- NIST SP 800-37
- NIST SP 800-115 (Correct answer)
- NIST SP 800-30
Correct answer: NIST SP 800-115
NIST SP 800-115 is the Technical Guide to Information Security Testing and Assessment, specifically covering penetration testing methodologies.
Question 3: A penetration tester uses a tool to automatically map out all hosts, open ports, and services on a target network. What phase of penetration testing does this represent?
- Exploitation
- Post-exploitation
- Reconnaissance and Discovery (Correct answer)
- Reporting
Correct answer: Reconnaissance and Discovery
Reconnaissance and discovery involves active scanning to enumerate hosts, ports, and services on the target network.
Question 4: What distinguishes a vulnerability scan from a penetration test in the context of federal system assessments?
- Vulnerability scans are always automated while penetration tests are always manual
- Penetration tests actively attempt to exploit vulnerabilities while scans only identify them (Correct answer)
- Vulnerability scans require written authorization but penetration tests do not
- Penetration tests use only commercial tools while vulnerability scans use open-source tools
Correct answer: Penetration tests actively attempt to exploit vulnerabilities while scans only identify them
Penetration tests go beyond identification by actively attempting to exploit vulnerabilities to demonstrate actual impact and risk.
Question 5: Under the CAP framework, who is ultimately responsible for authorizing penetration testing activities on a federal information system?
- The Penetration Tester
- The System Owner
- The Authorizing Official (AO) (Correct answer)
- The Information System Security Officer (ISSO)
Correct answer: The Authorizing Official (AO)
The Authorizing Official has the authority and accountability to accept risk, including approving assessment activities like penetration testing.
Question 6: A security team identifies a critical vulnerability in a production system but cannot patch it immediately due to operational constraints. What is the most appropriate interim measure from an RMF perspective?
- Accept the risk without documentation
- Implement a compensating control and document it in the POA&M (Correct answer)
- Immediately shut down the system
- Reclassify the vulnerability as low severity
Correct answer: Implement a compensating control and document it in the POA&M
Compensating controls mitigate risk when direct remediation is not feasible, and the residual risk must be documented in the Plan of Action and Milestones.
Question 7: Which type of penetration test provides the tester with full knowledge of the target system's architecture, source code, and network diagrams?
- Black-box testing
- Gray-box testing
- White-box testing (Correct answer)
- Red team testing
Correct answer: White-box testing
White-box testing gives testers complete knowledge of the target environment, enabling thorough assessment of internal logic and configurations.
CAP Vulnerability Assessment & Penetration Testing 2
During a penetration test, a tester discovers that a web application reflects user input directly in HTTP responses without encoding.
Which vulnerability class does this represent?