SE Vulnerability Assessment and Penetration Testing 1 — Questions and Answers
Question 1: What is the primary difference between a vulnerability assessment and a penetration test?
- Vulnerability assessments are illegal; pen tests are not
- A vulnerability assessment identifies weaknesses; a penetration test actively exploits them to demonstrate impact (Correct answer)
- Penetration tests are automated; vulnerability assessments are manual
- They are the same thing
Correct answer: A vulnerability assessment identifies weaknesses; a penetration test actively exploits them to demonstrate impact
Vulnerability assessments catalog known weaknesses, while penetration tests go further by exploiting vulnerabilities to confirm real-world risk.
Question 2: In a penetration test scope definition, what does 'rules of engagement' specify?
- The attacker's tools
- The boundaries, permitted actions, timing, and escalation procedures for the test (Correct answer)
- The client's security budget
- The list of CVEs to test
Correct answer: The boundaries, permitted actions, timing, and escalation procedures for the test
Rules of engagement define the scope, prohibited actions, notification requirements, and emergency contacts to ensure a controlled and legal test.
Question 3: Which CVSS metric indicates how complex the conditions must be for an attacker to exploit a vulnerability?
- Attack Vector
- Attack Complexity (Correct answer)
- Privileges Required
- User Interaction
Correct answer: Attack Complexity
The CVSS Attack Complexity metric reflects whether exploitation requires specific conditions beyond the attacker's control, such as race conditions.
Question 4: What type of scan discovers live hosts and open ports on a network without attempting exploitation?
- Exploitation scan
- Vulnerability scan
- Discovery / reconnaissance scan (Correct answer)
- Compliance scan
Correct answer: Discovery / reconnaissance scan
A discovery scan (e.g., using Nmap) maps the network, identifying live hosts and open services without testing for vulnerabilities.
Question 5: A tester has no prior knowledge of the target environment. Which type of penetration test is this?
- White-box test
- Gray-box test
- Black-box test (Correct answer)
- Crystal-box test
Correct answer: Black-box test
A black-box test simulates an external attacker with no insider knowledge, requiring the tester to perform full reconnaissance.
Question 6: Which vulnerability scoring system provides a standardized way to assess and communicate the severity of security vulnerabilities?
- STRIDE
- CVSS (Common Vulnerability Scoring System) (Correct answer)
- OWASP Top 10
- PASTA
Correct answer: CVSS (Common Vulnerability Scoring System)
CVSS provides a numerical score (0–10) based on exploitability and impact metrics to standardize vulnerability severity communication.
SE Vulnerability Assessment and Penetration Testing 1
What is the primary difference between a vulnerability assessment and a penetration test?