Examkin

Question

Difficulty: Very hardVulnerability Scanning and Assessment

Match each enterprise security assessment requirement with the vulnerability scanning method or configuration best suited to satisfy it.

  • Evaluating internal system patch levels and local configuration drift on remote worker laptops while minimizing network bandwidth consumption and VPN traffic.Agent-Based Vulnerability Scanning
  • Identifying unauthorized active services and unencrypted protocols on sensitive legacy Operational Technology (OT) devices prone to crashing under port probes.Passive Network Vulnerability Scanning
  • Evaluating dynamic web applications during runtime to identify injection vulnerabilities and authentication flaws without requiring access to source code.Dynamic Application Security Testing (DAST)
  • Assessing network-accessible target hosts across a corporate LAN to enumerate missing patches and missing security controls using domain administrative permissions.Credentialed Network-Based Vulnerability Scanning

Answer

Each assessment scenario correctly maps to its ideal vulnerability assessment approach: evaluating remote endpoint drift locally without VPN overhead requires Agent-Based Scanning; assessing sensitive legacy OT systems without active probe disruption requires Passive Network Scanning; testing live web applications for runtime flaws requires Dynamic Application Security Testing (DAST); and conducting authenticated central scans across network hosts using domain privileges requires Credentialed Network-Based Scanning.
Matching each scanning scenario requires balancing assessment goals against operational constraints. Agent-based scanning minimizes network overhead for remote laptops by executing locally. Passive scanning prevents fragile OT system crashes by analyzing existing network traffic. Dynamic Application Security Testing (DAST) assesses live web applications without source code. Credentialed network scanning provides deep visibility into network-connected hosts using administrative accounts.

Step-by-Step Solution

1
Analyze the constraint of remote worker endpoints and VPN bandwidth limitations.
Local host execution is required to avoid heavy network traffic over VPN, pointing directly to agent-based assessment.
Agent-based assessment offloads processing and scan execution locally to the endpoint.
2
Evaluate the sensitivity of legacy Operational Technology (OT) equipment.
Active scanning packets can overload fragile legacy stacks; non-intrusive traffic inspection (passive scanning) is required.
Passive scanners observe mirror/SPAN ports without sending traffic to target OT controllers.
3
Determine the application security testing methodology for live web applications.
Black-box assessment of a running web application corresponds to Dynamic Application Security Testing (DAST).
DAST interacts with running application interfaces to detect runtime flaws.
4
Identify the network scan configuration utilizing elevated permissions across a LAN.
Connecting remotely over the network with administrative privileges describes credentialed network scanning.
Credentialed network scans leverage administrative access over network management protocols to inspect internal configurations.

Key Concept

Vulnerability Scanning Methodologies and Deployment Models
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic