Examkin

Question

Difficulty: EasyVulnerability Assessment and Security Testing Methods

A security team is selecting security testing methods and assessment techniques for different operational scenarios. Match each security assessment method on the left with its corresponding operational description on the right.

  • Active Vulnerability ScanningSends crafted packets or queries directly to target hosts to identify open ports, unpatched software, and misconfigurations.
  • Passive Vulnerability ScanningAnalyzes network traffic signatures in real time without sending traffic probes or disrupting host operations.
  • Grey-Box Penetration TestingSimulates an attack using partial knowledge of internal infrastructure, such as standard user credentials and system diagrams.
  • Dynamic Application Security Testing (DAST)Evaluates running web applications from an external perspective by interacting with functional endpoints without access to source code.

Answer

Active Vulnerability Scanning matches with sending crafted packets directly to target hosts; Passive Vulnerability Scanning matches with analyzing network traffic signatures in real time; Grey-Box Penetration Testing matches with simulating an attack using partial internal knowledge; Dynamic Application Security Testing (DAST) matches with evaluating running web applications externally without access to source code.
Each assessment method correctly aligns with its execution context: Active scanning sends direct probes to discover vulnerabilities; Passive scanning non-intrusively monitors traffic; Grey-box testing utilizes partial system information; and DAST evaluates live applications dynamically without access to underlying source code.

Step-by-Step Solution

1
Identify active network testing mechanisms.
Active vulnerability scanning relies on sending probes directly to targets to query system state.
Direct host probing allows detection of specific service versions and missing patches.
2
Identify non-intrusive traffic monitoring techniques.
Passive scanning observes network traffic without injecting probes.
Monitoring packets preserves bandwidth and avoids disruption to sensitive hosts.
3
Differentiate penetration testing knowledge scopes.
Grey-box testing provides limited internal information like credentials or diagrams.
Partial visibility simulates an insider or compromised user threat scenario.
4
Classify application security testing frameworks.
DAST tests operating applications from the outside during execution.
Runtime analysis evaluates application responses without requiring source code.

Key Concept

Vulnerability Assessment and Security Testing Methods
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic