A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.
- Software Composition Analysis (SCA)Evaluates project dependencies and third-party libraries to identify known software vulnerabilities and licensing issues.
- Dynamic Application Security Testing (DAST)Executes automated runtime security testing against a running web application without access to underlying source code.
- Gray-Box Penetration TestingSimulates an attack using limited user credentials and partial internal documentation to mimic an insider threat.
- Credentialed Vulnerability ScanningUses administrative credentials to log into target systems and audit local patch levels, registry configurations, and software inventories.
Answer
Software Composition Analysis (SCA) matches with evaluating project dependencies; Dynamic Application Security Testing (DAST) matches with automated runtime testing of a live application; Gray-Box Penetration Testing matches with simulating an attack using limited credentials and partial documentation; Credentialed Vulnerability Scanning matches with using administrative credentials to audit local patch levels and configurations.
Each testing methodology serves a specific operational function during an assessment: Software Composition Analysis evaluates open-source components and software supply chain vulnerabilities; Dynamic Application Security Testing tests live web services without source code visibility; Gray-Box Penetration Testing assesses systems using partial knowledge and limited accounts; and Credentialed Vulnerability Scanning performs internal configuration audits with administrative access.
Step-by-Step Solution
Key Concept
Vulnerability Assessment and Security Testing Methods