Vulnerability Assessment Tools & Techniques Flashcards

Which technique uses known-good configuration baselines to detect deviations that may indicate a vulnerability or misconfiguration?

Answer: Compliance/configuration auditing

Configuration auditing compares system settings against established security baselines (e.g., CIS Benchmarks) to identify deviations that could introduce vulnerabilities.

An assessor runs a scan and receives results showing 'Port 22 open' on multiple servers. What additional step determines whether these represent a vulnerability?

Answer: Perform version detection and check against CVEs for the running SSH implementation

Version detection identifies the specific SSH software and version, which can then be cross-referenced against known CVEs to determine if a vulnerability actually exists.

What is 'fuzzing' in the context of vulnerability assessment tools?

Answer: Sending malformed or unexpected input to an application to discover crashes or vulnerabilities

Fuzzing involves sending invalid, unexpected, or random data to an application's inputs to trigger errors, crashes, or unexpected behaviors that reveal vulnerabilities.

Which tool is BEST suited for automated SSL/TLS vulnerability testing, including detection of POODLE, BEAST, and HEARTBLEED?

Answer: SSLyze

SSLyze is a Python-based tool that analyzes SSL/TLS configurations and tests for known vulnerabilities like POODLE, BEAST, ROBOT, and Heartbleed.

What is the primary difference between active and passive vulnerability assessment techniques?

Answer: Active techniques send traffic to targets; passive techniques observe existing traffic without interacting with targets

Active techniques probe systems by sending packets or requests, while passive techniques observe network traffic and logs without directly interacting with target systems.

A vulnerability assessment report should include remediation recommendations. Which element is MOST critical to include for each finding?

Answer: Prioritized, actionable steps to resolve the vulnerability along with its risk rating

Effective remediation guidance must be actionable and prioritized by risk so the organization can allocate resources efficiently to address the most critical vulnerabilities first.

Which scanning plugin or check type in Nessus specifically verifies whether installed software versions match vendor-released patches?

Answer: Local security checks (LSC)

Local security checks (LSC) use credentials to log into a system and compare installed software versions against the latest vendor patches to identify missing updates.