Match each enterprise security assessment objective on the left with the scanning configuration or methodology best suited to satisfy it on the right.
- Detecting OS patch deficiencies on short-lived, auto-scaling cloud compute nodes without relying on periodic network sweepsAgent-Based Vulnerability Scanning
- Identifying security vulnerabilities within application dependencies before software builds are pushed to production registriesStatic Container & Dependency Scanning
- Assessing authenticated user session security on a live web application without triggering automated account lockoutsCredentialed Dynamic Web Application Scanning with Throttled Authentication Scripts
- Discovering active services and rogue endpoints on a sensitive SCADA/ICS network segment without sending probe trafficPassive Network Monitoring
Answer
The correct pairings match each specific enterprise constraint with its appropriate scanning methodology: assessing short-lived auto-scaling nodes requires Agent-Based Vulnerability Scanning; inspecting application libraries pre-deployment requires Static Container & Dependency Scanning; testing authenticated web applications without lockout requires Credentialed Dynamic Web Application Scanning with Throttled Authentication Scripts; and discovering assets on sensitive SCADA networks requires Passive Network Monitoring.
Each assessment methodology addresses distinct operational constraints. Agent-based scanning is ideal for ephemeral cloud workloads because the scanner software executes locally as soon as the instance boots, sending results back to a central console without needing network probe access. Static container and dependency scanning shifts security left into the software development life cycle, analyzing manifest files and container layers before software reaches production. Credentialed dynamic web scanning allows deep inspection of post-authentication application logic, but requires specific throttling rules so automated fuzzing does not trigger account lockouts. Passive network monitoring reads raw traffic copies (SPAN/TAP) to build an asset inventory on sensitive industrial SCADA networks without generating active network traffic that could cause device crashes.
Step-by-Step Solution
Key Concept
Selecting and configuring vulnerability assessment methods appropriate for cloud, pipeline, web application, and operational technology (OT) environments.
Estimated Time:2m 30s