Examkin

Question

Difficulty: HardVulnerability Assessment and Security Testing Methods

A cybersecurity team is establishing security testing procedures across various stages of an enterprise application lifecycle and infrastructure deployment. Match each security testing method on the left with its corresponding operational characteristic or execution scenario on the right.

  • Static Application Security Testing (SAST)Inspects source code or compiled binaries without executing the application to identify flaws early in the software development lifecycle.
  • Dynamic Application Security Testing (DAST)Evaluates a running application from an external perspective by simulating client-side attacks against live functional endpoints.
  • Credentialed Vulnerability ScanningUses local authentication rights or system agents to accurately inventory missing security patches and configuration drift.
  • Passive Network Vulnerability ScanningMonitors network traffic non-intrusively via SPAN or TAP interfaces to discover live hosts without sending active probes.

Answer

Static Application Security Testing (SAST) pairs with inspecting source code at rest without execution. Dynamic Application Security Testing (DAST) pairs with testing live running applications from an external perspective. Credentialed Vulnerability Scanning pairs with using local system authentication rights to inventory patch levels. Passive Network Vulnerability Scanning pairs with non-intrusive traffic monitoring via SPAN or TAP interfaces.
Each testing method is paired with its defining operational characteristic: SAST analyzes unexecuted source code; DAST tests active applications dynamically; credentialed scanning authenticates locally to check internal patch levels; passive scanning sniffs network traffic non-intrusively without generating network probes.

Step-by-Step Solution

1
Differentiate between static and dynamic application security testing approaches.
SAST operates on non-running source code or binaries early in the SDLC, whereas DAST requires a live running application to simulate runtime attacks.
SAST is a white-box code inspection technique, whereas DAST is a black-box runtime evaluation technique.
2
Differentiate between credentialed active scanning and passive network monitoring.
Credentialed scanning logs directly into operating systems to evaluate configuration state, while passive scanning observes packet flows via network TAPs/SPAN ports without sending traffic.
Credentialed scans minimize false positives by accessing internal host details, whereas passive scans avoid disrupting sensitive operational networks.

Key Concept

Vulnerability Assessment and Security Testing Methods
Estimated Time:2m 0s
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic