Question

Difficulty: MediumVulnerability Assessment and Security Testing Methods

A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.

  • Software Composition Analysis (SCA)Evaluates project dependencies and third-party libraries to identify known software vulnerabilities and licensing issues.
  • Dynamic Application Security Testing (DAST)Executes automated runtime security testing against a running web application without access to underlying source code.
  • Gray-Box Penetration TestingSimulates an attack using limited user credentials and partial internal documentation to mimic an insider threat.
  • Credentialed Vulnerability ScanningUses administrative credentials to log into target systems and audit local patch levels, registry configurations, and software inventories.

Answer

Software Composition Analysis (SCA) matches with evaluating project dependencies; Dynamic Application Security Testing (DAST) matches with automated runtime testing of a live application; Gray-Box Penetration Testing matches with simulating an attack using limited credentials and partial documentation; Credentialed Vulnerability Scanning matches with using administrative credentials to audit local patch levels and configurations.
Each testing methodology serves a specific operational function during an assessment: Software Composition Analysis evaluates open-source components and software supply chain vulnerabilities; Dynamic Application Security Testing tests live web services without source code visibility; Gray-Box Penetration Testing assesses systems using partial knowledge and limited accounts; and Credentialed Vulnerability Scanning performs internal configuration audits with administrative access.

Step-by-Step Solution

1
Analyze the primary focus of Software Composition Analysis (SCA).
SCA targets third-party libraries, packages, and open-source dependencies incorporated into software products.
Security vulnerabilities often stem from outdated external software modules rather than custom code.
2
Differentiate runtime application assessment (DAST) from static code review.
DAST tests a live application from an external interface perspective without requiring source code access.
DAST discovers vulnerabilities such as SQL injection or cross-site scripting while the application runs.
3
Distinguish access levels in penetration testing methodologies.
Gray-box testing provides assessors with partial knowledge or low-privilege user credentials to test realistic insider user threat vectors.
Black-box provides zero prior knowledge, whereas white-box provides complete internal access and source code.
4
Evaluate the mechanism of credentialed vulnerability scanning.
Credentialed scanning logs directly into endpoints using valid system credentials.
Authenticated access allows low-impact inspection of OS patch levels, software registries, and internal configuration details.

Key Concept

Vulnerability Assessment and Security Testing Methods
Rate this question