Examkin

Question

Difficulty: HardVulnerability Assessment and Security Testing Methods

A lead security analyst is designing a vulnerability assessment strategy for an operational technology segment that hosts legacy embedded web services. Previous active credentialed vulnerability scans caused several legacy daemons to crash, resulting in unexpected system downtime. The analyst must establish continuous monitoring to identify unpatched vulnerabilities and service misconfigurations across this segment without transmitting synthetic packets that could disrupt host stability. Which of the following security assessment methods best fulfills these operational requirements?

  1. Implementing a passive network vulnerability scanner that inspects mirrored traffic from a SPAN port to identify software versions and potential security flaws.Answer
  2. B
    Deploying high-interaction honeypots inline between network switches to automatically filter out exploit payloads directed at the legacy services.
  3. C
    Configuring a web application firewall to perform scheduled configuration compliance audits on internal host file systems.
  4. D
    Scheduling aggressive unauthenticated TCP SYN port scans during non-peak maintenance windows with elevated packet transmission rates.

Answer

Implementing a passive network vulnerability scanner using mirrored network traffic (SPAN/TAP) provides continuous vulnerability assessment without injecting network probes or risking system crashes on fragile legacy devices.
Passive network vulnerability assessment inspects mirrored network traffic via SPAN/mirror ports or hardware TAPs. Because it captures and analyzes existing traffic without generating or injecting new packets into the network, it accurately identifies open ports, host OS signatures, and software vulnerabilities without risking service disruption or system crashes on sensitive legacy daemons.

Step-by-Step Solution

1
Analyze the scenario constraints and requirements.
Identified key constraints: fragile legacy embedded services, host instability caused by active scanning probes, and the need for continuous vulnerability monitoring without packet injection.
Active probing mechanisms send crafted or unexpected data frames that legacy protocol stacks frequently fail to handle gracefully.
2
Evaluate assessment methodologies against the zero-disruption requirement.
Passive scanning relies on monitoring existing packet flows mirrored via SPAN ports or network TAPs, avoiding direct host interaction.
Because no new packets are generated toward target hosts, passive scanners observe banner disclosures and protocol signatures completely out-of-band.
3
Distinguish passive monitoring from unsuitable active or detective controls.
Confirmed that passive network assessment satisfies continuous visibility goals while eliminating risk to fragile daemons.
Alternative controls either introduce active probe traffic or misapply threat deception and inline firewall technologies.

Key Concept

Passive vs. Active Vulnerability Assessment Methods
Estimated Time:1m 30s
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic