Security Assessment Flashcards

During a penetration test, a tester discovers a critical vulnerability but the engagement scope explicitly excludes the affected system. What should the tester do?

Answer: Immediately report the finding to the client and halt testing on that system

The tester must report out-of-scope findings to the client immediately without exploiting them, as the rules of engagement govern what systems can be tested.

Which vulnerability scanning technique sends crafted packets and analyzes responses to determine open ports and services without authenticating to the target?

Answer: Active scanning

Active scanning sends probes to targets and analyzes responses to discover open ports, services, and potential vulnerabilities without requiring credentials.

A security assessor finds that an organization rates all vulnerabilities as 'Critical' regardless of actual risk. Which CVSS component is the organization likely ignoring?

Answer: Environmental Score

The Environmental Score adjusts the CVSS base score based on the organization's specific environment, asset criticality, and existing controls, enabling contextualized risk ratings.

What is the primary purpose of conducting a gap analysis during a security assessment?

Answer: To compare current security posture against a target framework or standard

A gap analysis compares the organization's current security controls and practices against a target baseline such as NIST CSF or ISO 27001 to identify deficiencies.

Which type of assessment involves authorized simulated attacks that replicate tactics of real-world threat actors to test detection and response capabilities?

Answer: Red team exercise

Red team exercises use adversary simulation techniques to test an organization's people, processes, and technology against realistic attack scenarios.

An assessor wants to determine which vulnerabilities pose the greatest risk to the business. Which process combines vulnerability data with threat intelligence and asset criticality?

Answer: Risk-based vulnerability management

Risk-based vulnerability management prioritizes vulnerabilities by correlating scanner findings with threat intelligence, exploit availability, and business asset value.

During a web application assessment, a tester identifies that user-supplied input is reflected in HTTP response headers without sanitization. What vulnerability class does this represent?

Answer: HTTP Header Injection

HTTP Header Injection occurs when unsanitized user input is embedded in response headers, potentially enabling response splitting or cache poisoning attacks.