Tyler Hampton
Quiz por , criado more than 1 year ago

Explain the proper use of penetration testing versus vulnerability scanning.

16
0
0
Tyler Hampton
Criado por Tyler Hampton aproximadamente 6 anos atrás
Fechar

S+ Objective 3.8 Quiz

Questão 1 de 9

1

You recently completed a vulnerability scan on your network. It reported that several servers are missing key operating system patches. However, after checking the servers, you've verified the servers have these patches installed. Which of the following BEST describes this?

Selecione uma das seguintes:

  • False negative

  • Misconfiguration of servers

  • False positive

  • Servers not hardened

Explicação

Questão 2 de 9

1

You suspect that a database server used by a web application does not have current patches. Which of the following is the BEST action to take to verify the server has up-to-date patches?

Selecione uma das seguintes:

  • Vulnerability Scan

  • Port Scan

  • Protocol Analyzer

  • Host Enumeration

Explicação

Questão 3 de 9

1

An organization has a legacy server within the DMZ. It is running older software that is not compatible with current patches, so it remains unpatched. Management accepts the risk on this system, but wants to know if attackers can access the internal network if they successfully compromise this server. Which of the following is the MOST appropriate test?

Selecione uma das seguintes:

  • Vulnerability Scan

  • Port Scan

  • Code Review

  • Pentest

Explicação

Questão 4 de 9

1

Testers do not have access to product documentation or any experience with an application. What type of test will they MOST likely perform?

Selecione uma das seguintes:

  • Gray box

  • White box

  • Black box

  • Black hat

Explicação

Questão 5 de 9

1

Your organization has hired a group of external testers to perform a black box penetration test. One of the testers asks you to provide information about your internal network. What should you provide?

Selecione uma das seguintes:

  • A list of IP ranges and the types of security devices operational on the network

  • Network diagrams but without internal IP addresses

  • Access points to the network

  • Nothing

  • Some network diagrams and some IP addresses, but not all

Explicação

Questão 6 de 9

1

Which of the following tools is the MOST invasive type of testing?

Selecione uma das seguintes:

  • Pentest

  • Protocol Analyzer

  • Vulnerability Scan

  • HIDS

Explicação

Questão 7 de 9

1

Testers are analyzing a web application your organization is planning to deploy. They have full access to product documentation, including the code and data structures used by the application. What type of test will they MOST likely perform?

Selecione uma das seguintes:

  • Gray box

  • White box

  • Black box

  • Gray Hat

Explicação

Questão 8 de 9

1

Lisa recently an application to test the security posture of a database server running in a a test bed. What type of report will she retrieve to identify vulnerabilities that the application actually exploited?

Selecione uma das seguintes:

  • Penetration test report

  • Vulnerability report

  • Risk assessment report

  • Code review report

Explicação

Questão 9 de 9

1

Your organization outsourced development of a software module to modify the functionality of an existing proprietary application. The developer completed the module and is now testing it with the entire application. What type of testing is the developer performing?

Selecione uma das seguintes:

  • White box

  • Black box

  • Gray box

  • Code Review

Explicação