Font size
WorksheetsT5 - System Assessment and Testing
Total questions: 87
Worksheet time: 1hrs 27mins
What is the primary goal of a vulnerability management program?
Block all inbound internet traffic
Identify, prioritize, and remediate weaknesses on an ongoing basis
Replace all legacy systems with cloud systems
Encrypt every file on the network
Which factor MOST directly influences how often an organization should run vulnerability scans?
Employee dress code
Risk appetite
Building occupancy
Vendor warranty length
Regulatory requirements such as PCI DSS or FISMA MOSTLY affect which aspect of scanning?
Choice of operating system
Scan frequency and evidence requirements
Screen resolution of scan consoles
Number of technicians hired
In a credentialed scan, the scanner:
Uses only ICMP to identify hosts
Logs in to systems with supplied accounts to gather deeper configuration data
Only scans from outside the firewall
Cannot see patch levels
What is an intrusive plug-in in the context of vulnerability scanning?
A browser extension that blocks pop-ups
A scan check that may disrupt service or crash a system
A plug-in that only checks for informational issues
An add-on that encrypts scan traffic
Which statement best describes a discovery scan?
It verifies that specific vulnerabilities have been fixed
It scans only web applications
It maps out assets and open ports to see what is present
It checks compliance documentation
A validation scan is primarily used to:
Identify all unknown assets
Confirm that previously identified vulnerabilities have been remediated
Measure wireless signal strength
Identify phishing emails
What does an internal scan perspective typically show?
What an attacker on the internet can see
Only wireless access points
What an attacker or insider with internal network access could see
Only web applications
In the SCAP family, CVE primarily provides:
Standard device names
Standard configuration templates
Standard vulnerability identifiers
Standard encryption protocols
Which of the following assigns IDs to publicly known vulnerabilities?
Standard encryption algorithms
Common Vulnerability Scoring System (CVSS)
Common Vulnerabilities and Exposures (CVE)
Vulnerability assessment tools
What is the primary use of the Common Vulnerability Scoring System (CVSS)?
Assign IP addresses
Score vulnerability severity numerically
Configure firewalls
Encrypt scan data
Which BEST describes static application testing?
Running the app and injecting inputs
Analyzing source or compiled code without executing it
Fuzzing web forms
Intercepting network traffic only
Dynamic application testing primarily focuses on:
Reviewing design documents
Evaluating the application while it is running
Scoring vulnerabilities with CVSS
Reviewing backup logs
Which approach combines elements of static and dynamic testing and often involves agents or instrumentation in the runtime environment?
Interactive application security testing (IAST)
Packet sniffing
Port scanning
Sandboxing
Nikto and Arachni are examples of which type of tool?
Endpoint encryption clients
Web application vulnerability scanners
SIEM platforms
Patch management tools
A false positive in vulnerability scanning is:
A real vulnerability reported with low severity
A reported issue that does not actually exist
A vulnerability that is invisible to the scanner
A vulnerability with a CVSS of 0
A false negative is best described as:
A vulnerability the scanner correctly reports as low risk
A harmless issue reported as critical
A real vulnerability that the scan fails to detect
Any vulnerability with unknown impact
When a scan report lists severity/risk ratings, what does “severity” communicate?
Number of users affected
Likely impact if the vulnerability is exploited
Cost of the scanner license
Age of the system
Rules of engagement (ROE) for a penetration test should primarily define:
Employee vacation schedules
Scope, methods, time windows, and data-handling expectations
Annual salary for testers
Hardware warranty conditions
In a security audit, "evidence" usually refers to:
Marketing materials
Documentation or artifacts that prove a control is designed and operating effectively
User complaints
Security awareness posters
An executive summary in a test report is primarily written for:
Tier-1 technicians
System administrators only
Senior leadership and non-technical stakeholders
The scanner vendor
In the test → findings → remediation → retest lifecycle, what is the main purpose of the retest step?
Increase the number of findings
Confirm that remediation was effective
Reduce scanner license cost
Reset all severity ratings to low
An asset inventory used with vulnerability management should primarily help you:
Track cafeteria food orders
Identify which systems exist and how critical they are
Disable all wireless networks
Select wallpaper images
Why is it important to update scanner software and plug-ins regularly?
To change the color of the UI
To add new vulnerability checks and fix scanner vulnerabilities
To reduce the scanner's memory usage
To improve the scanner's user interface design
Which description best fits a security assessment compared to testing?
It only reviews financial data
It focuses on evaluating controls and risk posture more broadly, not just running tools
It never uses technical tools
It is always anonymous
Which factor is LEAST likely to be used when assigning a risk rating to a vulnerability?
Exploitability
Business impact
Asset criticality
Favorite color of the system admin
A K-12 district has low risk appetite and must meet PCI DSS requirements for its lunch payment system. Which scanning decision is MOST appropriate?
Run scans once every three years
Run regular automated scans and additional scans after significant changes
Never run scans; rely only on firewalls
Run scans only on teacher laptops
During a scan of the grade-reporting server, an intrusive plug-in causes the application to crash during school hours. Which step should have prevented this?
Running only discovery scans
Reviewing ROE and scheduling intrusive checks in approved maintenance windows
Setting CVSS to 10 for all vulnerabilities
Scanning only desktops
Your team needs to verify that a critical patch for an SSL vulnerability actually applied across all SIS servers. Which testing approach is MOST appropriate?
Non-credentialed external discovery scan
Credentialed validation scan targeting the SSL configuration
Password spraying attack
Wireless site survey
A Nessus report flags an old SMB vulnerability on a fully patched file server. The sysadmin believes it’s a false positive. What should they do FIRST?
Delete the report
Disable all SMB plug-ins
Check the server’s patch level and configuration manually against the finding description
Mark all SMB findings as accepted risk
A school’s web server later gets compromised by an RDP exploit that was not in the last scan report. What does this MOST likely illustrate?
False positive
False negative
Low severity issue
Proper remediation
An external scan shows the district’s VPN gateway has only a few exposed services. An internal scan of the same device reveals many more open ports. What is the BEST explanation?
Misconfigured DHCP
Different perspectives due to firewalls and segmentation
Scanner malfunction
Rogue wireless access points
Internal scans show almost no findings on student devices, but random spot checks reveal outdated systems. Which control is MOST likely hiding issues from the scanner?
Network segmentation blocking scan traffic to some VLANs
Overly aggressive password policy
High-speed switches
New laptops
The district just acquired a separate building and network from another organization. You want a quick, non-disruptive view of what’s there. Which scan is MOST appropriate initially?
Credentialed validation scan
Non-credentialed discovery scan from inside that network
Full intrusive pen test immediately
Web application scan only
A developer asks which testing method would identify input validation issues by sending crafted requests to a running web app. Which answer is MOST accurate?
Static testing
Dynamic application testing
Backup testing
Tape rotation testing
A security consultant wants real-time insight into how the app behaves while processing specific requests, using instrumentation inside the running code. Which technique are they describing?
IAST
Packet capture
Password cracking
Log rotation
The district’s public website keeps failing a PCI external scan due to outdated SSL ciphers. Which control is MOST effective for identifying and detailing this issue?
Nikto or Arachni web app scan against the site
Password policy review
Wireless heat map
Physical access audit
A principal reads an executive summary that says, “High-risk vulnerabilities exist on student information systems,” and panics about imminent data loss. What was MOST likely missing from the summary?
Technical jargon and plugin IDs
Clear risk context, timelines, and remediation plan
The scanner vendor’s logo
Color graphics
During a compliance audit, the auditor asks for evidence that monthly scans are being performed. Which item BEST meets this request?
A verbal statement from the sysadmin
A screenshot of the scan schedule and sample reports with dates
A list of technician names
The scanner license invoice
A scan identifies 2 critical vulnerabilities on the gradebook server and 80 medium issues on lab PCs. The team fixes only the easy medium issues first. Which risk management mistake are they MOST likely making?
Ignoring change management
Prioritizing quantity of fixes over impact
Overusing encryption
Running too many validation scans
Your team performs scans, generates findings, and starts remediation tickets but never schedules retests. Months later, you discover several “fixed” items still vulnerable. What part of the lifecycle failed?
Assessment
Reporting
Verification/validation
Identification
A penetration test of the district network proceeds without defined ROE, and the tester accidentally causes an outage during state testing. Which control would have MOST reduced this risk?
Enforcing multi-factor authentication
A signed, detailed rules-of-engagement document approved by leadership
Longer passwords
Automatic updates on student laptops
Scanner plug-ins haven’t been updated in over a year. A major RCE vulnerability disclosed last month is not flagged in scans. Which conclusion is MOST accurate?
The vulnerability doesn’t affect schools
The scanner likely lacks signatures for the new CVE due to outdated feeds
The network is fully patched
The firewall blocked the exploit permanently
A security engineer wants to automatically correlate vulnerabilities across multiple tools using standard identifiers. Which SCAP component would be MOST helpful?
CPE
CVE and CVSS references
WPA3
SNMP
The district chooses to use both a commercial scanner and OpenVAS for network scans. What security principle are they MOST directly applying?
Obfuscation
Defense in depth and tool diversity
Mandatory access control
Single point of failure
A junior tech disables entire families of plug-ins “to make scans faster,” without documenting what was changed. What is the MOST significant security risk?
Larger reports
Increase in false positives
Important vulnerability checks may never run, leading to missed issues
Loss of internet access
Asset criticality has been defined as: - Gradebook servers: critical - Library kiosks: low - Cafeteria menu site: medium Which remediation order BEST reflects this information after a scan?
Cafeteria → Kiosks → Gradebook
Gradebook → Cafeteria → Kiosks
Kiosks → Cafeteria → Gradebook
All at once, no prioritization
The network team deploys agents on key servers to send configuration data back to the vulnerability management platform. This MOST closely describes:
Non-credentialed scanning
Agent-based vulnerability assessment
Static application testing
Wireless intrusion detection
In your project, you diagrammed Plan → Test/Assess → Analyze → Report → Remediate → Retest → Monitor. A real incident shows that testing and reporting occurred, but remediation tickets were never created. Which stage failed?
Plan
Analyze
Remediate
Monitor
A consultant reviews policies, interviews staff, and verifies that required controls are in place without actively exploiting anything. Which activity are they MOST likely performing?
Penetration test
Security audit/assessment
Vulnerability scan
Social media review
A pen test uncovers a vulnerable club web server run by a student group. Who MOST needs a non-technical explanation of risk and remediation steps?
Tier-1 tech only
Director of Technology only
Building administrator responsible for the club and student safety
Internet service provider
A scan finds: - 2 critical vulnerabilities on SIS servers - 10 high on payroll - 60 medium on lab PCs Which remediation strategy is BEST?
Fix all medium issues first to reduce report length
Focus on SIS and payroll critical/high findings first, then address mediums by asset criticality
Defer all fixes until summer break
Fix lab PCs only because they are numerous
Your team is deciding policy for intrusive plug-ins on production systems. Which policy is BEST?
Disable all intrusive plug-ins permanently
Run intrusive plug-ins only in approved windows with ROE and change control
Run intrusive plug-ins continuously for maximum coverage
Only run intrusive plug-ins on student devices
Which is the BEST reason to choose credentialed scans in the district environment?
They always run faster than non-credentialed scans
They require no configuration
They provide deeper insight into patch levels and configurations, reducing false positives
They eliminate the need for audits
The security team is designing a scanner maintenance process. Which plan is BEST?
Update plug-ins once per year and rely on firewalls
Enable automatic daily plug-in updates and verify manually on a set schedule
Never update plug-ins to keep results consistent
Only update after a breach
Management complains about “too many false positives.” Which action is the BEST long-term response?
Disable families of checks to reduce noise
Tune scan templates and create a documented process for validating and recording true/false positives
Run fewer scans
Lower all severity ratings by one level
The school board will review security in the next meeting. Which report is MOST appropriate for them?
Raw Nessus CSV report
Detailed technical report with plugin IDs
Executive summary describing top risks, trends, and remediation status
Syslog extract from the firewall
You need to store scan results and audit evidence. Which practice is BEST?
Save everything to a public shared drive
Store reports in a restricted repository with access controls and regular backups
E-mail reports to everyone in the district
Print and stack them on your desk
The district wants a comprehensive assessment approach for externally accessible systems. Which combination is BEST?
Network vulnerability scans only
Network scans plus web application testing on public-facing sites
Physical security walkthrough only
Password policy review only
After patching a critical SSL bug, what is the BEST retest strategy?
Assume success and move on
Wait six months and scan again
Run a focused validation scan on affected systems and document results
Disable all SSL ciphers
A vendor-supplied student portal fails a pentest due to several high SQL injection issues. Which response is BEST?
Ignore the findings because the vendor is responsible
Immediately disconnect or restrict access, open a ticket with the vendor including technical details, and track remediation
Change the logo and hope the vendor fixes it later
Only inform students
You are designing a scan schedule considering risk appetite, regulatory, business, and technical constraints. Which plan is MOST appropriate for critical servers?
Monthly scans, plus additional scans after major changes
Scans only after incidents
Annual scans only
Continuous intrusive scans 24/7
A colleague asks whether using SCAP standards is worth the effort. Which justification is BEST?
They make reports look nicer.
They standardize IDs and scores so multiple tools and teams can speak the same vulnerability language.
They eliminate the need for patching.
They make scans invisible to attackers.
Before running an external pentest, which communication plan is BEST?
Tell no one to keep it realistic
Notify only students
Have ROE signed by leadership, inform help desk and NOC of windows and symptoms to expect
Announce all test details publicly on the website
When creating remediation tickets, which field from scan reports is MOST critical to include for tracking and correlation?
Scanner UI theme
Vulnerability ID (e.g., CVE/Plugin ID)
Scanner serial number
Technician’s favorite snack
You are writing SOPs for Tier-1 techs on handling suspected false positives/negatives. Which instruction is MOST important?
If you’re unsure, delete the finding.
Validate configuration against the description, document your steps, and escalate if you cannot conclusively verify.
Change the score to medium.
Disable that plug-in.
Which of the following BEST represents a mature assessment and testing program in a K-12 district?
One annual scan with no follow-up
Regular scanning, documented ROE for tests, risk-based prioritization, retesting, and reporting
Random scans with no documentation
Testing only when vulnerabilities are reported
A mature program is characterized by which of the following?
Executive reporting
Continuous, documented, and risk-driven processes
Only relying on vendor marketing claims
Only performing ad-hoc testing after breaches
How should you respond to a suggestion of running a surprise, after-hours pentest on production systems without leadership approval?
Approve it; realism is more important than policy
Approve only if they promise to be careful
Reject it; testing without ROE and approvals exposes the district to legal and operational risk
Ignore the suggestion
To satisfy an external compliance requirement, the district must demonstrate both internal and external vulnerability management. Which approach is BEST?
Internal scans only
External scans only
Regular internal scans plus quarterly external scans from an approved vendor
Rely only on antivirus
What is the BEST rebuttal to the claim, “As long as we run monthly scans, we’re automatically compliant with all frameworks”?
True, scans are all that matter.
Compliance usually requires broader controls, documentation, and sometimes specific scan types and evidence, not just a schedule.
We only need daily scans.
Compliance doesn’t care about scanning.
A manager proposes: “We should only fix critical vulnerabilities and ignore medium and low issues forever.” Which evaluation is MOST accurate?
Good idea; it saves time
Acceptable as long as we document it
It is a poor approach; all vulnerabilities should be addressed based on risk
Only critical vulnerabilities matter
You review two pentest ROE drafts: - Draft A: Lists scope, time windows, data-handling rules, and escalation paths. - Draft B: Says “Do whatever you need to; don’t tell anyone.” Which is BEST and why?
Draft A, because it controls risk and sets expectations
Draft B, because it is more realistic
Both are equal
Neither; ROE is unnecessary
Raw scan results containing internal IPs, hostnames, and exploits are placed on an unsecured shared drive accessible to all staff. What is the BEST assessment?
Acceptable; transparency is good
Risky; scan data is sensitive and could help attackers or curious insiders
Required for compliance
Harmless because it’s not real data
You must choose a scanning approach for: - 3 high-value servers (SIS, payroll, HR) - 200 student lab PCs Which plan is BEST?
Same minimal template, monthly, for all devices
More frequent, deeper credentialed scans for high-value servers; periodic broader scans for labs
Scan only lab PCs
Scan only servers
An external firm reviews whether controls are designed and operating effectively against a standard, while another team regularly runs scanners and pen tests. Which mapping is MOST accurate?
Firm = vulnerability testing, internal team = audit
Firm = audit, internal team = vulnerability testing
Firm = compliance testing, internal team = audit
Firm = penetration testing, internal team = compliance testing
You’re revising the “Security Assessment & Testing — Overview for Northrop Techs” guide. Which change would MOST improve its usefulness for Tier-1 technicians?
Remove the lifecycle diagram to save space
Add a section that shows example scan findings and how Tier-1 should create tickets with severity, asset, and evidence attached
Replace all text with marketing slogans
Aim the entire guide only at the school board
A security team wants to use real student data in a test environment to evaluate SQL injection defenses. Which step is MOST important before using the data?
Ensure the testing server uses the same database engine
Mask or anonymize all sensitive student information
Copy production logs to improve analyst accuracy
Export the data in CSV instead of SQL format
During a penetration test, the tester asks for a copy of the SIS (student information system) database to test query manipulation. What is the MOST appropriate response?
Provide read-only access to the real database
Give the tester a sanitized dataset containing no real student data
Deny the request and cancel the test
Provide full access if the tester signs the ROE
A technician uploads a vulnerability scan report containing IPs, OS versions, and open ports to a shared Google Drive accessible by teachers. What is the PRIMARY security concern?
Teachers may delete the report
CSV formatting may break
Sensitive infrastructure data is exposed to unauthorized users
Severity values may not sort correctly
A school district assigns data classifications to all items. What classification is MOST appropriate for vulnerability scan results?
Public
Internal
Sensitive
Public-with-restrictions
Why is auditor independence critical during a security audit?
It ensures the audit finishes more quickly
It guarantees high-severity findings
It prevents conflicts of interest and improves objectivity
It allows auditors to modify production systems
A system administrator who manages backups is assigned to audit the district’s backup controls. What is the MAIN problem?
They may choose the wrong tools
They cannot objectively audit a control they operate
They are too familiar with the system
They may not have enough time
A district wants more objective audits. Which option BEST increases independence?
Have the help desk manager audit every system
Allow network engineers to audit their own firewall rules
Hire an external auditor for annual control validation
Ask the database admin to audit patch compliance
During an audit, a technician says, “Just trust me—the server is patched.” What should the auditor request instead?
A written statement from the technician
Verbal confirmation from another staff member
A screenshot or log file showing patch status
A network diagram
In a K–12 district, who must ultimately approve penetration testing Rules of Engagement (ROE)?
Any Tier-1 technician
The building principal
The Director of Technology or CIO
The athletic director
A vendor offers a free pen test on the district’s SIS. A tech supervisor signs the ROE without informing leadership. What is the MOST serious concern?
The test may slow down Chromebooks
The ROE may violate FERPA or district data-handling rules
The pen test will find too many issues
The vendor may use a nonstandard tool
