Security Assessment Flashcards

Which penetration testing methodology specifically maps attack techniques to defensive controls using a structured knowledge base?

Answer: MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques used to map attacks to defensive controls.

A security assessor is evaluating an organization's web application. Which technique involves sending unexpected input to test for injection vulnerabilities?

Answer: Fuzzing

Fuzzing involves sending unexpected, malformed, or random data inputs to an application to discover vulnerabilities like injection flaws.

Under NIST SP 800-53, which control family is primarily responsible for security assessment and authorization activities?

Answer: CA - Assessment, Authorization, and Monitoring

The CA (Assessment, Authorization, and Monitoring) control family in NIST SP 800-53 covers security assessments, authorization, and continuous monitoring.

What is the primary purpose of a System Security Plan (SSP) in the context of security assessments?

Answer: To provide an overview of security requirements and controls implemented

An SSP documents the security requirements for an information system and describes how controls are implemented to meet those requirements.

During a security assessment, an assessor discovers that a critical patch has not been applied but the organization has documented compensating controls. What should the assessor do?

Answer: Document the vulnerability and evaluate whether compensating controls adequately mitigate the risk

Assessors must document findings and evaluate whether compensating controls sufficiently reduce risk to an acceptable level rather than automatically marking items compliant.

Which type of assessment involves evaluating security controls without prior knowledge of the system's architecture or configuration?

Answer: Black-box assessment

Black-box assessments simulate an external attacker with no prior knowledge of the target system's internals, architecture, or configuration.

What does CVSS Base Score measure in the context of vulnerability assessment?

Answer: The intrinsic severity of a vulnerability independent of time or environment

The CVSS Base Score represents the intrinsic characteristics of a vulnerability that are constant over time and across environments.