Sample questions
Pt Vulnerability Assessment Vs PentestDifficulty 1
A company wants to know whether its systems have known, publicly documented weaknesses (like missing patches or outdated software versions). Which type of engagement is designed to answer exactly that question, at scale, on a recurring schedule?
- aA red team engagement, because only adversary emulation can identify missing patches.
- bA vulnerability assessment (VA), because it uses automated scanning to compare systems against known vulnerability signatures.✓
- cA purple team workshop, because its structured collaborative sessions between attackers and defenders are designed to tune detection rules together, not to catalog missing patches across the fleet.
- dA safe-harbor legal review, because that document only covers authorization, not technical findings.
Explanation:A vulnerability assessment is built for breadth and repeatability: automated scanners compare software versions and configurations against known-vulnerability databases across many hosts on a regular cadence. It does not attempt to prove exploitability the way a penetration test does.
Pt Vulnerability Assessment Vs PentestDifficulty 1
What is the main difference between a vulnerability assessment and a penetration test in terms of what each one proves?
- aA vulnerability assessment definitively proves that a vulnerability is exploitable in the live production environment, while a pentest merely lists possible weaknesses without any hands-on validation.
- bThere is no real difference; the two terms describe the same activity performed by different vendors.
- cA vulnerability assessment lists potential weaknesses found by scanning, while a pentest attempts to actively validate which of them can really be leveraged.✓
- dA vulnerability assessment always requires manual testing, while a pentest is always fully automated.
Explanation:A VA produces a broad list of candidate issues from automated scanning, many of which may not be exploitable in practice. A pentest goes a step further and manually validates a subset of findings to confirm real-world impact and business risk.
Pt Vulnerability Assessment Vs PentestDifficulty 1
A vulnerability scanner flags a web server as running an outdated software version with a known CVE. Before this finding is reported to the client as confirmed risk, what should happen first?
- aSomeone should verify whether the flagged version and configuration actually match the conditions required for that CVE to apply, since scanners can misidentify versions.✓
- bThe finding should be published immediately, because automated scanner output is always accurate and needs no review.
- cThe finding should be deleted immediately from every tracking system, because any automatically generated scanner result is assumed by default to be a false positive regardless of the specific CVE involved.
- dThe client should be asked to patch the entire environment blindly without checking which system was actually flagged.
Explanation:Scanners often rely on banner grabbing or version strings, which can be wrong or incomplete, leading to false positives. A quick verification step (checking the actual version, configuration, or exposure) avoids reporting non-issues as confirmed risk.
Pt Vulnerability Assessment Vs PentestDifficulty 1
Which of the following best describes a 'false positive' in the context of a vulnerability scan?
- aA real vulnerability that the scanner correctly identified from the start and that was later independently confirmed through careful manual penetration testing.
- bA vulnerability that exists but that the scanner failed to detect at all during the scan.
- cA finding that was intentionally hidden from the report because it was out of scope.
- dA finding the scanner reports as a vulnerability, but which does not actually exist or is not exploitable once checked manually.✓
Explanation:A false positive is an incorrect alert: the tool reports a weakness that, upon closer inspection, is not really present or not actually exploitable in that context. Managing false positives well is central to keeping scan results trustworthy.
Pt Vulnerability Assessment Vs PentestDifficulty 1
What is CVSS (Common Vulnerability Scoring System) primarily used for?
- aIt is a legal framework that defines which systems are in scope during a penetration test.
- bIt is a standardized scoring system that expresses the technical severity of a vulnerability as a numeric score, helping teams compare and prioritize findings.✓
- cIt is an exploit database that lists working attack code for every published CVE.
- dIt is a mandatory government certification that a company must formally obtain and renew annually before regulators will ever allow it to run any red team exercise.
Explanation:CVSS translates technical characteristics of a vulnerability (such as how it can be reached and what impact it has) into a numeric score, giving teams a common language to compare severity across many findings.
Pt Vulnerability Assessment Vs PentestDifficulty 2
A CVSS base score is meant to describe which aspect of a vulnerability?
- aThe intrinsic technical severity of the vulnerability itself, independent of whether it has been exploited in the wild or of a specific company's environment.✓
- bThe exact financial loss a specific company will suffer if the vulnerability is exploited.
- cWhether the vulnerability has already been fixed by the vendor in the latest patch.
- dThe specific personal legal liability that each individual security team member carries if a given finding is not formally reported to regulators within exactly 24 hours.
Explanation:The base score captures characteristics that do not change over time or between deployments, such as how the vulnerability can be reached and what impact it can have. Temporal and environmental factors are handled separately and can adjust that base value.