SE Vulnerability Assessment and Penetration Testing

Question 1

What is the primary difference between a vulnerability assessment and a penetration test?

Accepted Answer

A vulnerability assessment identifies weaknesses; a penetration test actively exploits them to demonstrate impact

Answer

Vulnerability assessments are illegal; pen tests are not

Answer

Penetration tests are automated; vulnerability assessments are manual

Answer

They are the same thing

Question 2

In a penetration test scope definition, what does 'rules of engagement' specify?

Accepted Answer

The boundaries, permitted actions, timing, and escalation procedures for the test

Answer

The attacker's tools

Answer

The client's security budget

Answer

The list of CVEs to test

Question 3

Which CVSS metric indicates how complex the conditions must be for an attacker to exploit a vulnerability?

Accepted Answer

Attack Complexity

Answer

Attack Vector

Answer

Privileges Required

Answer

User Interaction

Question 4

What type of scan discovers live hosts and open ports on a network without attempting exploitation?

Accepted Answer

Discovery / reconnaissance scan

Answer

Exploitation scan

Answer

Vulnerability scan

Answer

Compliance scan

Question 5

A tester has no prior knowledge of the target environment. Which type of penetration test is this?

Accepted Answer

Black-box test

Answer

White-box test

Answer

Gray-box test

Answer

Crystal-box test

Question 6

Which vulnerability scoring system provides a standardized way to assess and communicate the severity of security vulnerabilities?

Accepted Answer

CVSS (Common Vulnerability Scoring System)

Answer

STRIDE

Answer

OWASP Top 10

Answer

PASTA