CCP Vulnerability Assessment & Penetration Testing 1 — Questions and Answers
Question 1: What is the primary difference between a vulnerability assessment and a penetration test?
- A vulnerability assessment actively exploits weaknesses, while a penetration test only identifies them
- A vulnerability assessment identifies and prioritizes weaknesses without exploiting them, while a penetration test attempts to actively exploit them (Correct answer)
- A vulnerability assessment is performed externally, while a penetration test is performed internally
- A vulnerability assessment requires written authorization, while a penetration test does not
Correct answer: A vulnerability assessment identifies and prioritizes weaknesses without exploiting them, while a penetration test attempts to actively exploit them
A vulnerability assessment identifies, classifies, and prioritizes vulnerabilities without exploiting them, while a penetration test goes further by actively attempting to exploit weaknesses to determine real-world impact.
Question 2: Which CVSS v3.1 score range is classified as 'Critical' severity?
- 7.0 – 8.9
- 6.0 – 7.9
- 9.0 – 10.0 (Correct answer)
- 8.5 – 10.0
Correct answer: 9.0 – 10.0
CVSS v3.1 defines Critical severity as scores from 9.0 to 10.0, representing vulnerabilities that are most severe and typically easily exploitable with devastating impact.
Question 3: During a penetration test, what does 'pivoting' refer to?
- Switching from a white-box to a black-box engagement mid-test
- Using a compromised host as a launching point to attack other systems within the network (Correct answer)
- Escalating privileges on a single compromised system
- Changing attack vectors after initial reconnaissance fails
Correct answer: Using a compromised host as a launching point to attack other systems within the network
Pivoting uses a compromised system as a relay or jump point to reach and attack other systems on the internal network that are not directly accessible from the attacker's position.
Question 4: What type of penetration test provides the tester with full knowledge of the target environment, including network diagrams, source code, and credentials?
- Black-box test
- Grey-box test
- Red team assessment
- White-box test (Correct answer)
Correct answer: White-box test
A white-box (or crystal/glass-box) penetration test gives the tester complete knowledge of the target environment, enabling thorough and efficient testing of the entire attack surface.
Question 5: Which tool is most commonly used for automated network vulnerability scanning in enterprise environments?
- Metasploit
- Burp Suite
- Nessus (Correct answer)
- Wireshark
Correct answer: Nessus
Nessus (by Tenable) is the industry-standard automated vulnerability scanner used to detect misconfigurations, missing patches, and known CVEs across network hosts.
Question 6: What does the OWASP Top 10 primarily focus on?
- The ten most common network-layer vulnerabilities
- The ten most critical security risks for web applications (Correct answer)
- The top ten malware families targeting enterprises
- The ten leading causes of data breaches per year
Correct answer: The ten most critical security risks for web applications
The OWASP Top 10 is a standard awareness document listing the ten most critical security risks specifically affecting web applications, updated periodically based on industry data.
Question 7: In the context of penetration testing, what is 'passive reconnaissance'?
- Scanning open ports on a target without sending exploit payloads
- Gathering information about a target using publicly available sources without directly interacting with the target's systems (Correct answer)
- Running vulnerability scans with credentials to reduce false positives
- Observing network traffic on an internal segment after gaining access
Correct answer: Gathering information about a target using publicly available sources without directly interacting with the target's systems
Passive reconnaissance collects information about a target through open-source intelligence (OSINT), DNS lookups, and public records without sending any traffic directly to the target, leaving no trace on their systems.
CCP Vulnerability Assessment & Penetration Testing 1
What is the primary difference between a vulnerability assessment and a penetration test?