Examkin

Question

Difficulty: MediumVulnerability Assessment and Security Testing Methods

A security operations team needs to implement continuous vulnerability assessment and security testing mechanisms for a cloud-hosted e-commerce application platform. The security objective is to identify runtime application vulnerabilities and network anomalies without degrading live user traffic performance or causing service interruptions on production database hosts. Which TWO of the following methods or practices best meet these operational requirements?

  1. Utilizing passive network monitoring via a SPAN port or network TAP to inspect unencrypted traffic and protocol anomalies without injecting packets into the live environmentAnswer
  2. B
    Deploying deception honeypots inline within the production application gateway to directly block and filter SQL injection payloads
  3. Executing Dynamic Application Security Testing (DAST) scans against isolated, non-production staging environments during continuous integration pipelinesAnswer
  4. D
    Applying host firewall rule updates on backend servers to detect and sanitize Cross-Site Scripting (XSS) payloads in database queries
  5. E
    Configuring network firewalls to automatically remediate memory buffer overflow vulnerabilities discovered on application servers

Answer

Passive network monitoring using SPAN ports or TAPs and executing Dynamic Application Security Testing (DAST) against non-production staging environments satisfy the assessment requirements without risking production stability.
Passive network monitoring using SPAN ports or TAPs reads mirrored traffic without adding network latency or risking system instability. Conducting DAST against isolated staging environments evaluates dynamic application behavior safely away from live production workloads.

Step-by-Step Solution

1
Analyze operational constraints
Identified the requirement to assess security posture and detect traffic anomalies without introducing latency, crash risks, or service disruptions to live production traffic and database systems.
Production safety requires passive monitoring or out-of-band active testing techniques.
2
Evaluate passive monitoring and testing methodologies
SPAN/TAP traffic mirroring allows passive packet inspection without latency, while DAST in non-production staging isolates active testing workloads from live microservices.
Both techniques effectively evaluate security posture while protecting production availability.
3
Identify misconceptions in distractors
Deception controls are not inline filtering systems, host firewalls do not sanitize client-side XSS scripts in database queries, and network firewalls cannot patch host-level software memory flaws.
Eliminates improper control assignments and tool misconfigurations.

Key Concept

Selecting appropriate vulnerability assessment techniques (passive traffic monitoring vs isolated DAST) to evaluate security posture without impacting production availability.
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic