Tenable Vulnerability Assessments Chapter 5
Practice Test 2026 | Verified Answers | Exam Prep
1. Describe the primary function of Maltego in the context of cybersecurity as
discussed in Chapter 5.
Maltego is used for gathering information from various sources,
including social media, to identify relationships and connections.
Maltego is primarily a vulnerability scanner for identifying weaknesses
in systems.
Maltego is used for encrypting data to secure communications.
Maltego is a tool for performing network scans to detect open ports.
2. A security professional is researching the latest vulnerabilities that have been
released. Where is a good resource they can go to in order to look at these?
Common Vulnerability Scoring System (CVSS)
Common Vulnerabilities and Exposures (CVE)
Information System Security Assessment Framework (ISSAF)
National Vulnerability Database (NVD)
3. What social networking site would likely be most useful for performing
reconnaissance against a target?
LinkedIn
WhatsApp
Facebook
Friendster
,4. Describe how static analysis differs from dynamic analysis in the context of
vulnerability scanning.
Static analysis examines the code without executing it, while
dynamic analysis tests the code during execution.
Static analysis requires more resources than dynamic analysis.
Static analysis is used for real-time scanning, while dynamic analysis is
used for periodic assessments.
Static analysis focuses on network vulnerabilities, while dynamic
analysis focuses on application vulnerabilities.
5. Iggy, a penetration tester, is conducting a black box penetration test. He
wants to do reconnaissance by gathering information about ownership, IP
addresses, domain name, locations, and server types. Which of the following
tools would be most helpful?
Nslookup
Whois
beSTORM
ARIN
6. Which tool is primarily used for validating vulnerabilities by exploiting them?
Nmap
Maltego
Metasploit
Nessus
7. If a cybersecurity team needs to conduct a vulnerability assessment during
off-peak hours, which tool mentioned in Chapter 5 would be most suitable
, for this task and why?
Nmap, because it is the fastest scanning tool available.
Wireshark, because it captures live network traffic.
Nessus, because it allows for customized scan jobs that can be
scheduled to run during off hours.
Maltego, because it focuses on social engineering vulnerabilities.
8. What is the primary purpose of using fuzzing tools in cybersecurity testing?
To monitor network traffic.
To encrypt sensitive data.
To enhance network speed.
To identify vulnerabilities in applications or systems.
9. An organization has recently completed a vulnerability assessment. Of the
following choices, what is the last step in this process?
remediate vulnerabilities
obtain permission from management
recommend feasible methods to reduce vulnerabilities
identify methods to reduce vulnerabilities
10. What type of packet does Computer 2 send in response to a SYN packet
from Computer 1 during a TCP handshake?
SYN-ACK
FIN
ACK
, RST
11. Describe the significance of the post-exploitation phase in a cybersecurity
attack.
The post-exploitation phase is concerned with network mapping.
The post-exploitation phase is primarily about initial access to the
system.
The post-exploitation phase is crucial as it involves gathering
evidence of compromise and understanding the extent of the
attack.
The post-exploitation phase focuses on scanning for vulnerabilities.
12. You are a security analyst of a large IT company and are responsible for
maintaining the organization's security posture. You are evaluating multiple
vulnerability assessment tools for your network. Given that your network has
a hybrid IT environment with on-premise and cloud assets, which tool would
be most appropriate considering its comprehensive coverage and visibility,
continuous scanning, and ability to monitor unexpected changes before they
turn into breaches?
Qualys Vulnerability Management
Nessus Professional
Open VAS
GFI LanCuard
13. Ann, a security administrator, has been instructed to perform fuzz-based
testing on the company's applications. Which of the following best describes
what she will do?
Work with the developers to eliminate horizontal privilege escalation
opportunities
Practice Test 2026 | Verified Answers | Exam Prep
1. Describe the primary function of Maltego in the context of cybersecurity as
discussed in Chapter 5.
Maltego is used for gathering information from various sources,
including social media, to identify relationships and connections.
Maltego is primarily a vulnerability scanner for identifying weaknesses
in systems.
Maltego is used for encrypting data to secure communications.
Maltego is a tool for performing network scans to detect open ports.
2. A security professional is researching the latest vulnerabilities that have been
released. Where is a good resource they can go to in order to look at these?
Common Vulnerability Scoring System (CVSS)
Common Vulnerabilities and Exposures (CVE)
Information System Security Assessment Framework (ISSAF)
National Vulnerability Database (NVD)
3. What social networking site would likely be most useful for performing
reconnaissance against a target?
Friendster
,4. Describe how static analysis differs from dynamic analysis in the context of
vulnerability scanning.
Static analysis examines the code without executing it, while
dynamic analysis tests the code during execution.
Static analysis requires more resources than dynamic analysis.
Static analysis is used for real-time scanning, while dynamic analysis is
used for periodic assessments.
Static analysis focuses on network vulnerabilities, while dynamic
analysis focuses on application vulnerabilities.
5. Iggy, a penetration tester, is conducting a black box penetration test. He
wants to do reconnaissance by gathering information about ownership, IP
addresses, domain name, locations, and server types. Which of the following
tools would be most helpful?
Nslookup
Whois
beSTORM
ARIN
6. Which tool is primarily used for validating vulnerabilities by exploiting them?
Nmap
Maltego
Metasploit
Nessus
7. If a cybersecurity team needs to conduct a vulnerability assessment during
off-peak hours, which tool mentioned in Chapter 5 would be most suitable
, for this task and why?
Nmap, because it is the fastest scanning tool available.
Wireshark, because it captures live network traffic.
Nessus, because it allows for customized scan jobs that can be
scheduled to run during off hours.
Maltego, because it focuses on social engineering vulnerabilities.
8. What is the primary purpose of using fuzzing tools in cybersecurity testing?
To monitor network traffic.
To encrypt sensitive data.
To enhance network speed.
To identify vulnerabilities in applications or systems.
9. An organization has recently completed a vulnerability assessment. Of the
following choices, what is the last step in this process?
remediate vulnerabilities
obtain permission from management
recommend feasible methods to reduce vulnerabilities
identify methods to reduce vulnerabilities
10. What type of packet does Computer 2 send in response to a SYN packet
from Computer 1 during a TCP handshake?
SYN-ACK
FIN
ACK
, RST
11. Describe the significance of the post-exploitation phase in a cybersecurity
attack.
The post-exploitation phase is concerned with network mapping.
The post-exploitation phase is primarily about initial access to the
system.
The post-exploitation phase is crucial as it involves gathering
evidence of compromise and understanding the extent of the
attack.
The post-exploitation phase focuses on scanning for vulnerabilities.
12. You are a security analyst of a large IT company and are responsible for
maintaining the organization's security posture. You are evaluating multiple
vulnerability assessment tools for your network. Given that your network has
a hybrid IT environment with on-premise and cloud assets, which tool would
be most appropriate considering its comprehensive coverage and visibility,
continuous scanning, and ability to monitor unexpected changes before they
turn into breaches?
Qualys Vulnerability Management
Nessus Professional
Open VAS
GFI LanCuard
13. Ann, a security administrator, has been instructed to perform fuzz-based
testing on the company's applications. Which of the following best describes
what she will do?
Work with the developers to eliminate horizontal privilege escalation
opportunities
