I85PREP
⌘ K
CSPT study materials
CSPT study resources

CSPT practice questions

One question at a time. Build your CSPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Engagement Management, Scoping and Rules of Engagement

Which statement best describes the function of a Rules of Engagement (RoE) document?

  1. It holds the technical findings that will be delivered to the client.
  2. It sets permitted targets, methods, timing and constraints. Correct answer.
  3. It lists the commercial milestones and invoicing schedule for the project.
  4. It replaces the master services agreement for the engagement.

Explanation

The RoE records how testing may be carried out: which assets may be touched, which techniques are allowed, when testing may occur, and how incidents are escalated. It is agreed and signed by someone able to authorize the work before activity starts. Commercial terms live in the contract, and results live in the report.

Question 2Engagement Management, Scoping and Rules of Engagement

Before testing an external client's internet-facing systems, what does the tester most need from the client?

  1. A list of previous penetration test reports from the client
  2. Verbal confirmation from the technical point of contact
  3. Signed authorization from an authorized officer Correct answer.
  4. A copy of the client's internal information security policy

Explanation

Written authorization signed by an individual with authority to bind the organization is what separates authorized testing from unauthorized access. A technical contact's verbal approval may not survive legal or contractual scrutiny. The signed document should identify the assets and the permitted activity.

Question 3Engagement Management, Scoping and Rules of Engagement

Which item is normally recorded in the scope section of a penetration test engagement?

  1. The hourly rate applied to retesting work
  2. The CVSS scores of the findings discovered so far
  3. The hosts, domains and applications to be tested Correct answer.
  4. The names of the testers assigned to the project

Explanation

Scope enumerates the assets that may be tested, such as IP ranges, domains, applications, APIs and accounts, and normally states explicit exclusions as well. Rates, staffing and findings belong in other documents or later deliverables. Anything not listed is out of bounds.

Question 4Engagement Management, Scoping and Rules of Engagement

A client insists that all test data, credentials and findings stay confidential. Which agreement primarily governs this?

  1. The service level agreement
  2. The master services agreement
  3. The statement of work addendum
  4. The non-disclosure agreement Correct answer.

Explanation

A non-disclosure agreement binds the parties to protect confidential information exchanged or discovered during the work. The other documents address commercial terms, deliverables or service levels rather than confidentiality of information. NDAs are typically signed before any sensitive material changes hands.

Question 5Engagement Management, Scoping and Rules of Engagement

An RoE states that testing may occur only between 22:00 and 04:00 local time. A tester's automated scanner is still running at 05:00 and producing results. What is the correct action?

  1. Let the scan finish so that the coverage is not lost.
  2. Continue the scan and disclose the overrun in the report.
  3. Restart the scan during the next permitted window.
  4. Stop the scan and log the overrun for the client. Correct answer.

Explanation

The testing window is a hard constraint in the RoE, so activity must cease when the window closes and any overrun must be recorded and disclosed promptly. Continuing past the window risks disrupting systems during business hours that the client deliberately excluded. Stopping and reporting preserves both the agreement and the evidence chain.

Question 6Engagement Management, Scoping and Rules of Engagement

A client asks you to test a web application hosted on a public cloud provider's infrastructure. What must be established first?

  1. That the cloud provider offers a bug bounty program
  2. That the provider's policy permits the activity Correct answer.
  3. That the client's DNS records are managed internally
  4. That the application uses a content delivery network

Explanation

Where assets are hosted by a third party, the provider's acceptable-use and testing policies still apply and may prohibit certain tests or require advance notification. The client's authorization does not override the provider's terms. This should be confirmed before any traffic is sent.

Question 7Engagement Management, Scoping and Rules of Engagement

During testing, a production database becomes unresponsive and the client's service degrades. What should the tester do first?

  1. Finish the current request and then check the logs
  2. Wait for the client to notice and contact the team
  3. Suspend testing and notify the emergency contact Correct answer.
  4. Roll back the database to the previous night's backup

Explanation

The RoE defines stop conditions that require the tester to halt activity immediately and use the agreed escalation channel so the client can respond. Testers should not attempt to remediate, restore or reconfigure client systems themselves. Prompt notification limits the impact and preserves the client's own recovery procedures.

Question 8Engagement Management, Scoping and Rules of Engagement

The client's SOC is receiving alerts from your scanning. What should have been agreed in advance to prevent wasted incident response effort?

  1. A signed waiver of the client's incident response duties
  2. A daily schedule of findings to be reported
  3. A copy of the tester's liability insurance certificate
  4. A list of tester source IPs and a deconfliction contact Correct answer.

Explanation

Deconfliction arrangements, typically known source addresses and named contacts on both sides, let the SOC distinguish tester traffic from a genuine intrusion. Without them the blue team may block the engagement or spend effort chasing authorized activity. These details belong in the RoE before testing begins.

Question 9Engagement Management, Scoping and Rules of Engagement

While testing, you extract a database table containing real customer records. What is the appropriate handling?

  1. Move it to your personal cloud drive for safekeeping
  2. Share it with the client's marketing team for analysis
  3. Keep a full copy in the report appendix as proof of impact
  4. Store it encrypted and delete it per the agreement Correct answer.

Explanation

Data encountered during testing remains the client's, and the RoE or contract should specify how it is protected, minimized and destroyed. Real personal data must not be redistributed or retained beyond the agreed period. Sufficient redacted evidence should be captured instead.

Question 10Engagement Management, Scoping and Rules of Engagement

Mid-engagement the client asks you to also test a newly acquired subsidiary's systems. What is the correct response?

  1. Obtain written authorization and updated scope first Correct answer.
  2. Begin testing immediately because the client asked for it
  3. Refuse, because scope cannot be altered once signed
  4. Test only the subsidiary's public website and note it

Explanation

Scope changes need the same authorization as the original engagement, because the subsidiary is a separate legal entity with its own assets and sign-off. The RoE and statement of work should be amended before any testing starts. Informal requests do not extend authorization.

Question 11Engagement Management, Scoping and Rules of Engagement

The client supplies privileged test accounts for the engagement. Which practice is appropriate?

  1. Store the credentials in the shared team chat for reference
  2. Reuse the same password across all test accounts for speed
  3. Use them only within scope and rotate afterwards Correct answer.
  4. Email the credentials to the whole team for convenience

Explanation

Credentials provided by the client are part of the authorized access path and must be protected and confined to the agreed targets. Rotation and revocation at engagement close prevent residual access. Handling rules should be written into the RoE.

Question 12Engagement Management, Scoping and Rules of Engagement

The RoE prohibits denial-of-service testing. A tester identifies a potentially crashing endpoint. What is the correct approach?

  1. Ask a colleague to test it without telling the client
  2. Send a single crafted request and observe quietly
  3. Run a small load test to confirm the crash remotely
  4. Report the suspicion without triggering the condition Correct answer.

Explanation

Techniques excluded by the RoE stay out of bounds even when a vulnerability looks promising, because availability impact was never authorized. The issue should be reported as a suspected finding with a recommendation for controlled verification. The client can then decide whether to widen scope.

Question 13Engagement Management, Scoping and Rules of Engagement

A client says the goal is 'to know if we are secure'. Which refinement best supports a measurable engagement?

  1. Extend the testing window by two additional weeks
  2. Increase the number of findings required in the final report
  3. Agree specific and measurable objectives with the client Correct answer.
  4. Add a second tester to the delivery team for coverage

Explanation

Objectives should be specific and verifiable so that coverage and success can be judged at the end of the engagement. Adding time, people or a findings quota does not make the underlying goal measurable. Clear objectives also make it easier to scope the assets and techniques required.

Question 14Engagement Management, Scoping and Rules of Engagement

You discover that an in-scope server stores credentials for an out-of-scope system. What should you do?

  1. Use the credentials to prove the out-of-scope risk
  2. Record it and raise it through the agreed channel Correct answer.
  3. Test the out-of-scope system with read-only actions
  4. Quietly ignore it, as it is outside the scope

Explanation

Findings that touch out-of-scope assets are reported, not exploited, because authorization does not extend to those systems. The RoE escalation path lets the client decide whether to expand scope. Documenting the observation preserves value without exceeding authority.

Question 15Engagement Management, Scoping and Rules of Engagement

How does a statement of work (SOW) differ from rules of engagement (RoE)?

  1. The SOW lists techniques; the RoE lists pricing
  2. The SOW is signed by testers and the RoE by the client
  3. The SOW covers deliverables; the RoE covers conduct Correct answer.
  4. The SOW is optional and the RoE is legally binding

Explanation

The statement of work is the commercial document describing services, deliverables and timelines, while the RoE describes how testing will be conducted. Both should be agreed and signed before testing starts. They complement each other rather than duplicating content.

Question 16Engagement Management, Scoping and Rules of Engagement

What is the main purpose of a kickoff meeting before testing begins?

  1. To demonstrate exploits to the client's developers
  2. To negotiate the final price of the engagement
  3. To confirm contacts, scope, timing and escalation Correct answer.
  4. To deliver the draft report to the client's executives

Explanation

A kickoff aligns both sides on scope, schedule, key contacts and escalation routes before any traffic is sent. It reduces the chance of scope disputes and missed incident notifications. Commercial negotiation and reporting happen at other stages.

Question 17Engagement Management, Scoping and Rules of Engagement

Why does an engagement contract typically include indemnification and liability clauses?

  1. To allocate responsibility for unintended damage Correct answer.
  2. To fix the number of testers deployed on the project
  3. To guarantee that no vulnerabilities will be missed
  4. To ensure findings remain confidential between the parties

Explanation

Penetration testing carries a risk of disruption, so contracts allocate financial responsibility and set liability caps for unintended harm. These clauses are negotiated legal terms, not technical promises about outcomes. Confidentiality and staffing are handled by separate provisions.

Question 18Engagement Management, Scoping and Rules of Engagement

You plan to bring a subcontractor onto the engagement. What must happen before they touch client systems?

  1. They should sign a personal promise to work carefully
  2. They should receive the scope spreadsheet from the lead
  3. They should be added to the client's internal chat channels
  4. They must be bound by the same agreements and authorized Correct answer.

Explanation

Subcontractors need their own confidentiality and authorization coverage, and the client must agree to their involvement, since authorization extends only to named parties. Handing over scope documents does not confer authorization. This should be resolved contractually before any testing activity.

Question 19Engagement Management, Scoping and Rules of Engagement

Your team is in one country and the client's servers are in another. Why does this matter for authorization?

  1. Foreign systems can be tested under the tester's home law
  2. The client's written authorization applies worldwide
  3. Only the country of the tester's company has jurisdiction
  4. Other jurisdictions may impose additional legal limits Correct answer.

Explanation

Computer-misuse and data-protection laws differ between countries, so the location of the tester, the client and the assets can each impose obligations. Legal review should confirm that the authorization satisfies every relevant jurisdiction. A single signed letter may not cover all of them.

Question 20Engagement Management, Scoping and Rules of Engagement

The client asks for a retest six weeks after the report is delivered. What should the retest scope define?

  1. A full repeat of the original engagement at no cost
  2. Which findings, hosts and techniques the retest covers Correct answer.
  3. Only the critical findings, unless the client objects
  4. The new vulnerabilities found by the client's own team

Explanation

Retest scope should state exactly which findings and assets will be re-verified, along with any techniques and constraints, so effort and evidence are bounded. It is not automatically a repetition of the whole original engagement. Agreeing this in advance prevents disputes over coverage.

Question 21Reconnaissance and Information Gathering

An assessor wants to discover hostnames on a target domain by looking at certificates that were issued for it. Which data source is most directly suited to this?

  1. Historical WHOIS records for the domain
  2. The target's published DNS zone file
  3. Certificate Transparency logs Correct answer.
  4. The target's robots.txt file

Explanation

Certificate Transparency logs are public, append-only records of every certificate a CA issues, including the subjectAltName entries. Querying them (for example through crt.sh) yields hostnames that were never linked publicly. WHOIS, zone files, and robots.txt do not enumerate certificates.

Question 22Reconnaissance and Information Gathering

What does a WHOIS lookup on a domain primarily return?

  1. The complete set of DNS records published for the domain
  2. The open ports detected on the registrant's mail server
  3. The TLS certificate chain presented by the web server
  4. Registrar, creation date, and registrant contacts Correct answer.

Explanation

A WHOIS query reaches the registry or registrar directory and returns registration metadata: registrar, key dates, nameservers, and any published contacts or organization details. DNS and TLS data come from separate services.

Question 23Reconnaissance and Information Gathering

A web application's robots.txt file lists several Disallow entries. What is the security-testing relevance of this file?

  1. It encrypts the listed paths so they cannot be enumerated
  2. It logs every crawler that has visited the site
  3. It enforces access control, so listed paths cannot be requested by a tester
  4. It can disclose sensitive paths the owner would rather keep unindexed Correct answer.

Explanation

robots.txt tells well-behaved crawlers which paths to skip; it does not enforce access control, so listed paths remain reachable. Because owners often list admin panels, staging areas, or backup directories there, it is a useful enumeration lead.

Question 24Reconnaissance and Information Gathering

Which search engine operator limits results to pages on a single specified host or domain?

  1. inurl:
  2. intitle:
  3. site: Correct answer.
  4. filetype:

Explanation

The site: operator restricts results to URLs on the specified host or domain, which makes it useful for enumerating indexed content belonging to a target. filetype: filters by document extension, intitle: matches page titles, and inurl: matches text inside the URL.

Question 25Reconnaissance and Information Gathering

Which DNS record type should an assessor review first when the goal is to map a target's email infrastructure?

  1. CNAME
  2. AAAA
  3. SOA
  4. MX Correct answer.

Explanation

MX records name the mail exchangers that accept mail for a domain, which immediately identifies the mail provider and the hosts worth examining. From there an assessor can check SPF alignment, gateway versions, and related subdomains.

Question 26Reconnaissance and Information Gathering

An assessor queries a third-party passive DNS database for hostnames belonging to a target. How is this activity classified?

  1. Passive, because no traffic is sent to the target's own systems Correct answer.
  2. Active, because the DNS queries reach the target's nameservers
  3. Active, because the database resolves names live at query time
  4. Active, because DNS is inherently an active protocol

Explanation

Reconnaissance is passive when the assessor never sends traffic to the target's own systems; querying a third-party database keeps the target unaware. Active reconnaissance involves direct interaction, such as resolving against the target's nameservers or scanning its hosts.

Question 27Reconnaissance and Information Gathering

A nameserver answers a dig AXFR request for the zone from an unauthorized client with the full record set. What should the assessor record as the finding?

  1. DNSSEC validation is disabled for the zone
  2. The nameserver is vulnerable to DNS cache poisoning attacks
  3. The server is running a version of BIND with known flaws
  4. The zone is transferable by unauthorized clients Correct answer.

Explanation

A successful AXFR from an unauthorized source means the nameserver hands the entire zone, including internal-only hostnames, to any client that asks. The finding should record the exposed record set and the nameserver responsible.

Question 28Reconnaissance and Information Gathering

During subdomain brute forcing, every random label resolves to the same IP address. What does this indicate?

  1. A wildcard DNS record is answering, so hits must be filtered Correct answer.
  2. The target publishes wildcard certificates for all names
  3. The wordlist contains only valid hostnames
  4. The resolver is returning cached answers from a previous query

Explanation

A wildcard record such as *.example.com matches any label, so every lookup in the brute force returns the same address. Results must be compared against that wildcard baseline before any discovered host is reported.

Question 29Reconnaissance and Information Gathering

What does an SPF TXT record for a domain specify?

  1. Which ports the mail server accepts connections on
  2. Which certificate authorities may issue certificates for the domain
  3. Which hosts are authorized to send email for the domain Correct answer.
  4. Which nameservers are authoritative for the domain

Explanation

SPF is published in a TXT record and lists the hosts and mechanisms authorized to send mail for the domain, helping receivers reject forgeries. It also discloses third-party senders such as marketing platforms.

Question 30Reconnaissance and Information Gathering

Which capability most distinguishes Shodan from a conventional web search engine during reconnaissance?

  1. Indexing only the pages linked from a target's home page
  2. Resolving domain names faster than public resolvers
  3. Searching internet-wide service banners by product or port Correct answer.
  4. Storing historical WHOIS records for each domain

Explanation

Shodan continuously scans the internet and indexes the banners services return, so it can be searched by product, port, or header without any traffic reaching the target. That makes it a passive reconnaissance resource rather than a page index.

Question 31Reconnaissance and Information Gathering

An assessor computes a hash of a target's favicon and searches for that hash in Shodan. What is the purpose of this step?

  1. To brute force the directory containing the favicon
  2. To verify the favicon's TLS certificate is valid
  3. To find other hosts serving the same application Correct answer.
  4. To detect whether the favicon file contains embedded malware

Explanation

A favicon hash acts as a fingerprint for a web application, so searching the hash returns other hosts running the same product, including staging or forgotten deployments. It is a passive way to expand the asset inventory.

Question 32Reconnaissance and Information Gathering

What is the primary purpose of running WhatWeb against a live web endpoint?

  1. To fingerprint servers, frameworks, and libraries in use Correct answer.
  2. To enumerate valid usernames through response timing
  3. To capture and replay authenticated sessions
  4. To fuzz request parameters for injection vulnerabilities

Explanation

WhatWeb identifies the server, frameworks, CMS, and JavaScript libraries by matching responses and headers against signatures. The result guides later testing but does not itself test for vulnerabilities.

Question 33Reconnaissance and Information Gathering

Why would an assessor query the Wayback Machine during reconnaissance?

  1. To view the source code of the server's backend
  2. To check whether the target's TLS certificate has expired
  3. To recover retired pages and endpoints no longer linked Correct answer.
  4. To obtain the target's current DNS zone data

Explanation

Web archives store snapshots of pages over time, so retired endpoints, old parameters, and removed comments can still be retrieved. Those artefacts often point at functionality that remains live on the current site.

Question 34Reconnaissance and Information Gathering

An assessor searches a public code-hosting site for the target's domain name. What class of exposure is being looked for?

  1. Missing DMARC records on subdomains
  2. Secrets and internal hostnames in committed code Correct answer.
  3. Open recursive DNS resolvers
  4. Unpatched TLS ciphers on the target's web servers

Explanation

Public repositories frequently contain secrets, internal hostnames, and configuration committed by developers, and a domain-based search surfaces them. Any discovered credential must be handled according to the engagement's rules.

Question 35Reconnaissance and Information Gathering

A subdomain's CNAME points to a cloud service hostname that now returns NXDOMAIN. What is the most likely security implication?

  1. An attacker may claim the resource and host content on that name Correct answer.
  2. The record will be automatically removed after the TTL expires
  3. The subdomain is protected by DNSSEC and cannot be hijacked
  4. The parent domain's registrar has expired the registration

Explanation

When a CNAME points at a resource that no longer exists, whoever registers that resource controls the content served under the trusted subdomain. This is the classic dangling-record subdomain takeover pattern.

Question 36Reconnaissance and Information Gathering

Which query best identifies the IP ranges an organization owns when the goal is to scope a perimeter assessment?

  1. A lookup of the organization's ASN and its announced prefixes Correct answer.
  2. A PTR lookup against each address of the mail server
  3. An NS lookup to identify the authoritative nameservers
  4. A TXT query against the organization's primary domain

Explanation

Every announced prefix belongs to the ASN that originates it, so looking up the organization's ASN and its announced prefixes gives the address space to scope. Individual PTR, TXT, or NS lookups reveal only isolated names.

Question 37Reconnaissance and Information Gathering

What does the Nmap -sn option perform during host discovery?

  1. SYN scan of the thousand most common TCP ports
  2. Ping scan that identifies live hosts without port scanning Correct answer.
  3. OS fingerprinting based on TCP/IP stack behaviour
  4. UDP scan of well-known service ports

Explanation

The -sn option performs host discovery only, using probes such as ICMP echo, TCP SYN to 443, and ARP on local networks, then reports which hosts are up without scanning ports. Port scanning requires different options.

Question 38Reconnaissance and Information Gathering

Why is reverse DNS considered weak evidence when mapping an IP address to an organization?

  1. PTR records are encrypted and cannot be read by public resolvers
  2. PTR records are generated automatically from WHOIS contact data
  3. The address owner sets them, and they may be stale or generic Correct answer.
  4. PTR records exist only for IPv6 reverse zones

Explanation

PTR records are published by whoever controls the address block, not by the organization using the hostname, and they are often left as generic provider names or outdated entries. They are a lead to corroborate with forward lookups and routing data.

Question 39Reconnaissance and Information Gathering

What does a passive DNS database such as SecurityTrails or VirusTotal provide?

  1. Live zone transfers performed against authoritative servers
  2. The private keys used by a domain's TLS certificates
  3. Port scan results for every host in a domain
  4. Historical name-to-address resolutions collected over time Correct answer.

Explanation

Passive DNS providers collect and retain responses observed across the internet, showing which addresses a name resolved to in the past and which names shared an address. This history exposes infrastructure that has since been moved.

Question 40Reconnaissance and Information Gathering

An assessor wants URL data for a target that predates any current crawling. Which approach best fits?

  1. Querying a public web-archive corpus such as Common Crawl Correct answer.
  2. Running a directory brute force with a large wordlist
  3. Querying the Shodan API for open ports on the target
  4. Enumerating subdomains through a certificate transparency tool

Explanation

Common Crawl and similar corpora periodically archive large portions of the web, and their URL indexes can be queried for a domain to recover pages and paths from earlier periods. The technique is passive and sends nothing to the target.

Question 41Reconnaissance and Information Gathering

Two apparently unrelated sites share the same Google Analytics tracking identifier. What does this most likely reveal to an assessor?

  1. A load balancer distributing traffic between the sites
  2. A common owner or operator behind both sites Correct answer.
  3. Identical web server software versions on both hosts
  4. A shared TLS certificate covering both hostnames

Explanation

A shared tracking identifier usually means one party operates or administers both sites, so it is a strong pivot for finding related infrastructure. It is a correlation lead that should be confirmed rather than treated as proof.

Question 42Reconnaissance and Information Gathering

A domain's TXT records include verification strings for several SaaS providers. What is the reconnaissance value of this observation?

  1. They prove the providers are configured securely
  2. They reveal third-party services the organization uses Correct answer.
  3. They disclose the internal IP addresses of the providers
  4. They list the mail servers authorized to send email

Explanation

Host-verification TXT records are issued per provider, so their presence shows which SaaS platforms, gateways, or collaboration tools the organization has onboarded. Each one expands the third-party attack surface worth reviewing.

Question 43Reconnaissance and Information Gathering

Which approach is best suited to discovering subdomains that use names not present in any public source?

  1. Reviewing historical WHOIS records
  2. Querying certificate transparency logs for the domain
  3. Searching a passive DNS database
  4. Brute forcing labels from a curated wordlist Correct answer.

Explanation

Labels that no public source has ever recorded must be guessed, and a curated wordlist of common development, staging, and service names finds them. Public sources such as certificate logs, passive DNS, and WHOIS only reveal names that already leaked.

Question 44Reconnaissance and Information Gathering

JavaScript loaded from the target's site references several storage bucket names. What is the most appropriate follow-up during reconnaissance?

  1. Download their contents on the assumption they are public
  2. Conclude the buckets belong to a third party and ignore them
  3. Report a vulnerability immediately without further checking
  4. Verify ownership and access settings within scope Correct answer.

Explanation

Bucket names in client-side code are a lead to check, but confirming ownership and testing access settings must stay within the agreed scope and rules of engagement. Downloading content without authorization can exceed scope and destroy evidence.

Question 45Vulnerability Analysis and Validation

In CVSS, what does the base score group describe?

  1. the observed exploitation rate in public threat intelligence feeds
  2. traits adjusted for the organization's deployed compensating controls
  3. intrinsic traits that remain constant across time and environments Correct answer.
  4. the residual severity after the vendor releases an official patch

Explanation

The CVSS base metrics describe intrinsic properties of a vulnerability that are constant over time and across environments. Temporal metrics account for changing exploit or remediation conditions, and environmental metrics account for a specific organization's context.

Question 46Vulnerability Analysis and Validation

In CVSS v3.1, which metric captures whether an attacker must first authenticate?

  1. Privileges Required Correct answer.
  2. User Interaction
  3. Scope
  4. Attack Vector

Explanation

Privileges Required records the level of access or authentication an attacker needs before exploiting the flaw. Attack Vector describes the path of attack, User Interaction records whether a victim must act, and Scope records whether impact crosses a security boundary.

Question 47Vulnerability Analysis and Validation

What is a false positive in vulnerability analysis?

  1. A real flaw that the scanner failed to report at all
  2. A flaw scored lower than the organization's risk threshold
  3. A reported flaw that cannot be reproduced or has no impact Correct answer.
  4. A finding that duplicates another team's open ticket

Explanation

A false positive is a finding that the tool or analyst reports as a vulnerability but that does not actually exist or cannot be shown to have security impact. False negatives are the opposite: real flaws that are missed.

Question 48Vulnerability Analysis and Validation

What is the main purpose of a proof of concept during vulnerability validation?

  1. It confirms that the vendor has released an official patch for the flaw
  2. It assigns a unique CVE identifier for public tracking of the flaw
  3. It proves the flaw can actually be triggered and has impact Correct answer.
  4. It calculates the exact CVSS base score for the finding

Explanation

A proof of concept demonstrates that a suspected flaw can be triggered under realistic conditions and produces the claimed security impact. This helps separate real vulnerabilities from scanner noise and supports accurate severity assessment.

Question 49Vulnerability Analysis and Validation

What does CWE classify?

  1. Organizational risk tolerance levels
  2. Public exploit kits sold on criminal markets
  3. Classes of software weaknesses Correct answer.
  4. Individual vulnerability instances reported by vendors

Explanation

CWE is a taxonomy of software weakness types, such as injection or buffer overflow. Individual vulnerability instances are identified by CVEs, while exploit kits and risk tolerance levels are separate concepts.

Question 50Vulnerability Analysis and Validation

What is the first appropriate step when a new scanner finding appears?

  1. Close the report as a false positive without further review
  2. Publish a public advisory describing the suspected flaw
  3. Immediately notify every customer listed in the asset inventory
  4. Reproduce it in a controlled, authorized test environment Correct answer.

Explanation

Validation begins by safely reproducing the finding within the authorized scope so the team can confirm exploitability and impact. Notification, closure, and disclosure decisions should follow only after validation and triage.