Examkin

Question

Difficulty: Very hardVulnerability Assessment and Security Testing Methods

A security engineering team is designing a vulnerability assessment and security testing strategy for a cloud-native microservices application processing sensitive payment data. To comply with enterprise governance, the testing pipeline must evaluate software components early in the development lifecycle without causing service instability, and inspect containerized workloads for known software vulnerabilities before deployment. Which of the following security assessment methods and testing controls should the team implement to fulfill these requirements? (Select TWO)

  1. Integrate Static Application Security Testing (SAST) into the source code repository pipeline to analyze uncompiled code for security flaws prior to build execution.Answer
  2. Perform authenticated vulnerability scanning against container images stored in the container registry prior to production deployment.Answer
  3. C
    Conduct invasive active penetration testing and high-rate fuzzing directly against live production database nodes during peak business transaction hours.
  4. D
    Deploy high-interaction deception honeypots inline within microservice application pods to automatically drop SQL injection attack payloads.
  5. E
    Replace application vulnerability scanning with network-level perimeter stateful firewalls to inspect memory for buffer overflow flaws.

Answer

The correct testing controls are integrating Static Application Security Testing (SAST) into the source code pipeline and performing authenticated vulnerability scanning on container images in the registry.
Integrating Static Application Security Testing (SAST) allows developers to analyze uncompiled source code for security vulnerabilities early in the development lifecycle (shift-left approach). Additionally, authenticated vulnerability scanning of container images within a container registry ensures that underlying operating system packages, embedded libraries, and application dependencies are thoroughly checked for known vulnerabilities prior to deployment into production microservices clusters.

Step-by-Step Solution

1
Identify early lifecycle testing requirements for source code analysis.
Static Application Security Testing (SAST) evaluates source code without executing the application, identifying vulnerabilities before build artifacts are created.
Meets the requirement for shifting security left in the CI/CD pipeline.
2
Determine container workload assessment methods prior to runtime.
Authenticated container registry scanning audits image layers, OS packages, and dependencies for known CVEs before deployment.
Ensures unpatched or vulnerable container images are barred from entering production microservices clusters.
3
Evaluate and discard disruptive or misconfigured control methods.
Active production fuzzing, inline honeypot payload filtering, and perimeter firewalls fail to meet non-disruptive software vulnerability assessment requirements.
Eliminates improper tool deployment and disruptive testing techniques in production environments.

Key Concept

Vulnerability Assessment and Security Testing Methods Across CI/CD and Container Pipelines
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic