CCP Vulnerability Assessment & Penetration Testing 2 — Questions and Answers
Question 1: What is a 'false positive' in vulnerability scanning?
- A vulnerability that exists but is not exploitable in the current configuration
- A scan result that reports a vulnerability that does not actually exist on the target (Correct answer)
- A critical vulnerability that the scanner assigns a low severity score
- An exploit attempt that fails due to network filtering
Correct answer: A scan result that reports a vulnerability that does not actually exist on the target
A false positive occurs when a vulnerability scanner incorrectly reports a vulnerability that does not actually exist on the scanned system, requiring manual validation to filter out inaccurate findings.
Question 2: Which phase of penetration testing involves using tools like Shodan, WHOIS, and LinkedIn to collect target information before active scanning?
- Exploitation
- Post-exploitation
- Reconnaissance (Correct answer)
- Reporting
Correct answer: Reconnaissance
Reconnaissance (also called information gathering) is the first phase of penetration testing, where testers collect as much information as possible about the target using both passive and active techniques before launching attacks.
Question 3: A SQL injection attack works by:
- Injecting malicious SQL queries into user-supplied input fields to manipulate a backend database (Correct answer)
- Intercepting SQL traffic between a client and database server and replaying it
- Exploiting misconfigured database ports to gain direct network access
- Using SQL commands embedded in phishing emails to harvest credentials
Correct answer: Injecting malicious SQL queries into user-supplied input fields to manipulate a backend database
SQL injection inserts or 'injects' malicious SQL code into input fields that are passed to a backend database, potentially allowing attackers to read, modify, or delete data and bypass authentication.
Question 4: What is the purpose of the CVE (Common Vulnerabilities and Exposures) system?
- To provide a standardized scoring system for rating vulnerability severity
- To provide a publicly available catalog of known cybersecurity vulnerabilities with unique identifiers (Correct answer)
- To track active exploitation of vulnerabilities in the wild
- To certify penetration testers who discover new vulnerabilities
Correct answer: To provide a publicly available catalog of known cybersecurity vulnerabilities with unique identifiers
CVE provides a standardized list of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier (e.g., CVE-2021-44228), enabling consistent communication across tools, vendors, and security teams.
Question 5: What does 'privilege escalation' mean in the context of penetration testing?
- Obtaining administrative access to a vulnerability scanner
- Gaining higher-level permissions on a system than those initially obtained during exploitation (Correct answer)
- Moving from a compromised host to adjacent systems on the network
- Increasing the scan depth of an automated vulnerability assessment
Correct answer: Gaining higher-level permissions on a system than those initially obtained during exploitation
Privilege escalation is the process of exploiting a vulnerability or misconfiguration to gain elevated permissions (e.g., moving from a standard user to Administrator or root) on a system already accessed.
Question 6: Which web application penetration testing tool acts as an intercepting proxy, allowing testers to inspect and modify HTTP/HTTPS traffic between a browser and a web server?
- Nmap
- Nessus
- Burp Suite (Correct answer)
- Aircrack-ng
Correct answer: Burp Suite
Burp Suite is a comprehensive web application testing platform that includes an intercepting proxy to capture, inspect, and modify HTTP/HTTPS requests and responses in real time.
Question 7: A buffer overflow vulnerability occurs when:
- A web application fails to encrypt data stored in memory buffers
- A program writes more data to a buffer than it was allocated, potentially overwriting adjacent memory and allowing code execution (Correct answer)
- An attacker floods a network buffer to cause packet loss and denial of service
- A database buffer fills up and begins logging queries to an insecure location
Correct answer: A program writes more data to a buffer than it was allocated, potentially overwriting adjacent memory and allowing code execution
A buffer overflow happens when a program writes data beyond the allocated memory buffer boundary, overwriting adjacent memory regions, which can enable an attacker to overwrite return addresses and execute arbitrary code.
CCP Vulnerability Assessment & Penetration Testing 2
What is a 'false positive' in vulnerability scanning?