A security operations team is configuring an automated vulnerability management workflow for a hybrid cloud environment containing both ephemeral container workloads and legacy database servers. Which of the following scanning strategies should the team implement to minimize network overhead while ensuring accurate detection of OS-level vulnerabilities? (Select TWO.)
- Deploy lightweight host-based agents on persistent database servers to perform authenticated internal system checks.Cevap
- Integrate vulnerability scanners directly into the CI/CD pipeline to analyze container images prior to deployment.Cevap
- CDeploy network-based Web Application Firewalls (WAFs) to actively scan network ports and remediate missing OS patches.
- DConfigure aggressive unauthenticated network scans across all VLANs during peak production hours to capture live system state.
Cevap
The team should deploy host-based agents on persistent database servers and integrate container image scanning into the CI/CD deployment pipeline.
Deploying host-based agents on persistent servers provides detailed credentialed assessment results without generating heavy network traffic. Similarly, integrating container scanning into the CI/CD pipeline ensures container images are assessed for vulnerabilities before being spawned, addressing the ephemeral nature of container workloads efficiently.
Adım Adım Çözüm
Anahtar Kavram
Selecting appropriate vulnerability scanning methodologies (agent-based vs. network-based vs. static pipeline image scanning) based on infrastructure environment constraints.