SE Vulnerability Assessment and Penetration Testing 2 — Questions and Answers
Question 1: During a web application penetration test, a tester sends `' OR '1'='1` in a login field and successfully bypasses authentication. What vulnerability is present?
- Cross-site scripting (XSS)
- Command injection
- SQL injection (Correct answer)
- LDAP injection
Correct answer: SQL injection
The input manipulates an SQL query's logic to return true for all records, bypassing the intended authentication check via SQL injection.
Question 2: What is a false positive in the context of vulnerability scanning?
- A vulnerability that is exploitable but not reported
- A reported vulnerability that does not actually exist in the target (Correct answer)
- A vulnerability with a CVSS score above 9.0
- A critical patch that was not applied
Correct answer: A reported vulnerability that does not actually exist in the target
A false positive occurs when a scanner reports a vulnerability that, upon manual verification, does not actually exist or is not exploitable.
Question 3: Which reconnaissance technique gathers information about a target using publicly available sources without directly interacting with the target's systems?
- Active reconnaissance
- Port scanning
- OSINT (Open Source Intelligence) (Correct answer)
- Banner grabbing
Correct answer: OSINT (Open Source Intelligence)
OSINT collects information from public sources such as WHOIS, social media, job postings, and DNS records without touching the target's infrastructure.
Question 4: A penetration tester establishes persistence on a compromised host and then moves to other internal systems. What phase does the lateral movement represent?
- Reconnaissance
- Initial access
- Privilege escalation
- Post-exploitation / lateral movement (Correct answer)
Correct answer: Post-exploitation / lateral movement
Lateral movement occurs during post-exploitation when an attacker pivots from an initial foothold to additional internal systems.
Question 5: Which framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to guide penetration testing scenarios?
- OWASP
- NIST CSF
- MITRE ATT&CK (Correct answer)
- ISO 27001
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a knowledge base of real-world adversary TTPs organized by tactic, used to model and test against realistic attack scenarios.
Question 6: What is the purpose of a penetration test report's executive summary?
- Provide detailed technical exploitation steps
- Summarize risk and business impact for non-technical stakeholders (Correct answer)
- List every CVE discovered
- Document scanner configuration
Correct answer: Summarize risk and business impact for non-technical stakeholders
The executive summary translates technical findings into business risk language for leadership who need to make risk decisions without deep technical knowledge.
SE Vulnerability Assessment and Penetration Testing 2
During a web application penetration test, a tester sends `' OR '1'='1` in a login field and successfully bypasses authentication.
What vulnerability is present?