Examkin

Soru

Zorluk: OrtaVulnerability Assessment and Security Testing Methods

A security operations team needs to implement continuous vulnerability assessment and security testing mechanisms for a cloud-hosted e-commerce application platform. The security objective is to identify runtime application vulnerabilities and network anomalies without degrading live user traffic performance or causing service interruptions on production database hosts. Which TWO of the following methods or practices best meet these operational requirements?

  1. Utilizing passive network monitoring via a SPAN port or network TAP to inspect unencrypted traffic and protocol anomalies without injecting packets into the live environmentCevap
  2. B
    Deploying deception honeypots inline within the production application gateway to directly block and filter SQL injection payloads
  3. Executing Dynamic Application Security Testing (DAST) scans against isolated, non-production staging environments during continuous integration pipelinesCevap
  4. D
    Applying host firewall rule updates on backend servers to detect and sanitize Cross-Site Scripting (XSS) payloads in database queries
  5. E
    Configuring network firewalls to automatically remediate memory buffer overflow vulnerabilities discovered on application servers

Cevap

Passive network monitoring using SPAN ports or TAPs and executing Dynamic Application Security Testing (DAST) against non-production staging environments satisfy the assessment requirements without risking production stability.
Passive network monitoring using SPAN ports or TAPs reads mirrored traffic without adding network latency or risking system instability. Conducting DAST against isolated staging environments evaluates dynamic application behavior safely away from live production workloads.

Adım Adım Çözüm

1
Analyze operational constraints
Identified the requirement to assess security posture and detect traffic anomalies without introducing latency, crash risks, or service disruptions to live production traffic and database systems.
Production safety requires passive monitoring or out-of-band active testing techniques.
2
Evaluate passive monitoring and testing methodologies
SPAN/TAP traffic mirroring allows passive packet inspection without latency, while DAST in non-production staging isolates active testing workloads from live microservices.
Both techniques effectively evaluate security posture while protecting production availability.
3
Identify misconceptions in distractors
Deception controls are not inline filtering systems, host firewalls do not sanitize client-side XSS scripts in database queries, and network firewalls cannot patch host-level software memory flaws.
Eliminates improper control assignments and tool misconfigurations.

Anahtar Kavram

Selecting appropriate vulnerability assessment techniques (passive traffic monitoring vs isolated DAST) to evaluate security posture without impacting production availability.
Bu soruyu puanla

Konular

Vulnerability Assessment and Security Testing Methods

Bu konudan daha fazla soru