Security Assessment Flashcards

What is the key distinction between a vulnerability assessment and a penetration test?

Answer: Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact

Vulnerability assessments identify and classify weaknesses, while penetration tests go further by actively exploiting vulnerabilities to demonstrate real-world impact.

In the RMF process, which step involves formally granting authorization to operate based on assessment results?

Answer: Authorize

The Authorize step involves an authorizing official reviewing assessment results and the risk determination to formally grant or deny authorization to operate.

Which document formally communicates the results of a security control assessment to organizational leadership?

Answer: Security Assessment Report (SAR)

The Security Assessment Report (SAR) documents the findings and recommendations from a security control assessment for organizational decision-makers.

An organization needs to assess 500 endpoints for known vulnerabilities. Which approach is most appropriate?

Answer: Authenticated network vulnerability scanning

Authenticated network vulnerability scanning efficiently assesses large numbers of endpoints using credentials to perform thorough checks without manual inspection.

What is the purpose of scope definition in a security assessment engagement?

Answer: To establish which systems, networks, and testing methods are included or excluded

Scope definition establishes clear boundaries for what is included and excluded in the assessment to prevent unintended disruption or legal issues.

Which security assessment technique examines application source code to identify vulnerabilities without executing the program?

Answer: Static Application Security Testing (SAST)

SAST analyzes application source, bytecode, or binary code for vulnerabilities without requiring the application to be running.

A Plan of Action and Milestones (POA&M) is primarily used to:

Answer: Track and manage identified security weaknesses and remediation schedules

A POA&M is a corrective action plan that tracks identified security weaknesses, resources needed, and scheduled completion dates for remediation.