CSS CSS Vulnerability Management & Penetration Testing 2

Question 1

What is the primary purpose of a bug bounty program?

Accepted Answer

Incentivizes security researchers to responsibly disclose vulnerabilities in exchange for rewards

Answer

Bug bounty programs leverage the broader security research community to identify vulnerabilities that internal teams might miss, creating a responsible disclosure channel.

Question 2

Which type of penetration test is conducted without any prior knowledge of the target environment?

Accepted Answer

Black-box testing

Answer

Black-box testing simulates an external attacker with no insider knowledge, testing the organization's defenses from the attacker's perspective.

Question 3

What is the OWASP Top 10 used for in application security?

Accepted Answer

A regularly updated list of the most critical web application security risks

Answer

The OWASP Top 10 documents the most prevalent and impactful web application vulnerabilities, serving as a baseline for secure development and security testing.

Question 4

What is the risk-based approach to vulnerability prioritization?

Accepted Answer

Prioritizes remediation based on the combination of vulnerability severity, asset criticality, and exploitability

Answer

Risk-based prioritization considers not just CVSS score but also how critical the affected asset is and whether active exploits exist, ensuring limited resources focus on the highest-risk items first.

Question 5

Which tool is commonly used by penetration testers for network discovery and security auditing?

Accepted Answer

Nmap (Network Mapper)

Answer

Nmap is a widely used open-source tool for network discovery that identifies live hosts, open ports, services, and operating system details.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS CSS Vulnerability Management & Penetration Testing 2