Web and application pentesting: understanding vulnerabilities Quiz

Quiz: reporting and remediation

Pass mark: 70%. You can retry as many times as you need.

1 Which elements are essential in a detailed finding of a vulnerability report? (several answers) Multiple answers possible A specific title and a plain-language description Raw tool output pasted with no analysis Reproducible steps and minimal evidence The impact and an actionable recommendation

2 In CVSS, which question is part of the exploitability metrics? Single answer How much data could be exposed (confidentiality) Whether the attacker needs privileges, or a user must interact How many pages the report contains Which tool was used to find the flaw

3 Which statements about CVSS limits are correct? (several answers) Multiple answers possible It measures technical severity, not business risk by itself It automatically accounts for chains of several vulnerabilities Two people can choose slightly different values, so reasoning should be documented A 7.0 to 8.9 base score is rated High

4 While using a website that has no bug bounty programme, you notice what looks like a vulnerability. What is the best course of action? Single answer Explore further to prove how serious it is, then publish it Ask the owner for payment in exchange for the details Stop testing and report it briefly and neutrally through an appropriate security contact Download the data to prove that the flaw is real

5 Which practices define a responsible participant in a bug bounty programme? (several answers) Multiple answers possible Staying within the scope stated in the policy Using real customers’ accounts to show a realistic impact Using their own test accounts and doing the minimum to prove the issue Keeping the details confidential until the issue is fixed or an agreed date