Examkin

Soru

Zorluk: ZorVulnerability Assessment and Security Testing Methods

During a post-incident review following an enterprise security evaluation, a security operations team discovers that an automated vulnerability scan failed to identify a critical unpatched remote code execution vulnerability on an internal database server. Simultaneously, the scan report flagged numerous high-severity vulnerabilities on an edge API gateway that manual verification confirmed were false positives. System logs reveal that the scanner performed service banner grabbing, port identification, and basic packet probing across subnets without host-level credentials or local management agents. Which assessment methodology limitation best explains why the scanner failed to detect the internal database flaw while producing false positives on the gateway?

  1. The scanner performed a non-credentialed scan, which lacked authenticated access to inspect internal patch levels and misinterpreted customized service banners from the API gateway.Cevap
  2. B
    The vulnerability assessment team applied preventive network filtering controls during the scan window, causing the scanner to block patch inspection requests to the database.
  3. C
    The database server was operating as an inline deception technology system that intentionally diverted scan probes to protect production assets.
  4. D
    The security team configured host-based firewalls to prevent SQL injection exploits during the vulnerability testing window.

Cevap

The scan performed a non-credentialed assessment, which lacks the elevated local privileges required to query internal patch management databases and relies on surface service banners that easily cause false positives.
Non-credentialed vulnerability scans inspect target systems strictly from an external network perspective. Because the scanner lacks administrative access to query local system registries, software manifests, and patch management records, it cannot verify whether specific security hotfixes have been applied, resulting in a false negative for the database vulnerability. Additionally, non-credentialed scanners rely heavily on service banner grabbing; when an edge device such as an API gateway presents modified or generic service headers, the scanner misinterprets the response and reports false positives.

Adım Adım Çözüm

1
Analyze the operational parameters of the vulnerability scan.
The scan was executed without host-level credentials or local management agents, relying solely on network-level probing, port scanning, and banner grabbing.
Understanding the visibility level of the scanner is critical for evaluating its accuracy and detection capabilities.
2
Evaluate the cause of the false negative on the internal database server.
Unpatched remote code execution flaws often reside in deep system software libraries or local configuration files that cannot be queried over the network without authenticated administrative access.
Non-credentialed scans cannot inspect installed updates or internal registry settings, leading to missed vulnerabilities.
3
Evaluate the cause of the false positives on the edge API gateway.
Service banner grabbing relies on strings returned by listening ports. API gateways often mangle, obfuscate, or proxy these headers, leading the scanner to falsely match known vulnerability signatures against incorrect software versions.
Surface-level banner matching without credentialed verification frequently produces false positives when middleboxes or custom proxies alter service headers.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Assessment Methodologies
Bu soruyu puanla

Konular

Vulnerability Assessment and Security Testing Methods

Bu konudan daha fazla soru