CCP Vulnerability Assessment & Penetration Testing 2

Question 1

What is a 'false positive' in vulnerability scanning?

Accepted Answer

A scan result that reports a vulnerability that does not actually exist on the target

Answer

A false positive occurs when a vulnerability scanner incorrectly reports a vulnerability that does not actually exist on the scanned system, requiring manual validation to filter out inaccurate findings.

Question 2

Which phase of penetration testing involves using tools like Shodan, WHOIS, and LinkedIn to collect target information before active scanning?

Accepted Answer

Reconnaissance

Answer

Reconnaissance (also called information gathering) is the first phase of penetration testing, where testers collect as much information as possible about the target using both passive and active techniques before launching attacks.

Question 3

A SQL injection attack works by:

Accepted Answer

Injecting malicious SQL queries into user-supplied input fields to manipulate a backend database

Answer

SQL injection inserts or 'injects' malicious SQL code into input fields that are passed to a backend database, potentially allowing attackers to read, modify, or delete data and bypass authentication.

Question 4

What is the purpose of the CVE (Common Vulnerabilities and Exposures) system?

Accepted Answer

To provide a publicly available catalog of known cybersecurity vulnerabilities with unique identifiers

Answer

CVE provides a standardized list of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier (e.g., CVE-2021-44228), enabling consistent communication across tools, vendors, and security teams.

Question 5

What does 'privilege escalation' mean in the context of penetration testing?

Accepted Answer

Gaining higher-level permissions on a system than those initially obtained during exploitation

Answer

Privilege escalation is the process of exploiting a vulnerability or misconfiguration to gain elevated permissions (e.g., moving from a standard user to Administrator or root) on a system already accessed.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Vulnerability Assessment & Penetration Testing 2