Examkin

Soru

Zorluk: Çok zorVulnerability Assessment and Security Testing Methods

During an infrastructure security review of a high-frequency financial transaction processing service, security operations observed that active credentialed vulnerability scanning triggered service account lockouts and unacceptable latency spikes on production database nodes. The engineering team requires an assessment approach that identifies software security flaws and system configuration weaknesses without initiating active network probes, modifying authentication states, or disrupting live operations. Which security testing methodology best addresses these operational constraints?

  1. Deploy passive network traffic monitoring alongside offline static application security testing (SAST) of codebase repositories.Cevap
  2. B
    Deploy high-interaction honeypots inline within the production network path to intercept scan traffic and dynamically absorb service account authentication attempts.
  3. C
    Reconfigure perimeter firewall rules to block SQL injection payloads from entering internal database segment interfaces during vulnerability scans.
  4. D
    Execute Cross-Site Scripting (XSS) fuzzing scripts against database listening ports to assess input parameter sanitization.

Cevap

Implementing passive network traffic monitoring combined with offline static application security testing (SAST) provides comprehensive vulnerability visibility without sending active network probes, causing latency spikes, or triggering account lockouts on production services.
Combining passive network monitoring with static application security testing (SAST) provides effective vulnerability identification while adhering to strict non-intrusive operational boundaries. Passive scanning inspects network traffic out-of-band without injecting packets or performing authentication attempts, eliminating account lockouts and server latency. SAST inspects source code directly without requiring execution in a live production environment.

Adım Adım Çözüm

1
Analyze operational constraints
Identified strict requirements: no active probing, no account state modifications, no latency spikes, and zero disruption to live database nodes.
Active credentialed vulnerability scans currently cause production degradation and lockouts.
2
Evaluate testing methodologies against non-intrusive requirements
Passive network monitoring observes packet headers and signatures via SPAN/TAP ports without generating traffic, while SAST analyzes application logic offline.
Both techniques operate out-of-band and introduce zero overhead to live database processes.
3
Differentiate correct methodology from unsuitable assessment and defense controls
Active fuzzing, inline deception technologies, and network firewalls either fail to assess flaws or actively disrupt live services.
Only non-intrusive passive monitoring paired with static analysis fulfills both flaw identification and operational uptime requirements.

Anahtar Kavram

Passive Vulnerability Assessment and Static Testing Methods
Bu soruyu puanla

Konular

Vulnerability Assessment and Security Testing Methods

Bu konudan daha fazla soru