Vulnerability Scanning Concepts

Question 1

Uses automated vulnerability scanner and observes reports and findings. Does not take down systems, apps or services and does not disrupt business.

Answer 1

Passively test security controls.

Question 2

Understanding common attacks and taking inventory of vulnerabilities –scanners report missing updates, misconfigured security settings and known exploits

Answer 2

Identify vulnerability

Question 3

Vulnerability scanners can identify missing patches or antivirus

Answer 3

Identify lack of security controls

Question 4

Weak passwords, default usernames and passwords, and open ports.

Answer 4

Identify common misconfigurations

Question 5

can interrupt service, us much more detailed, and exploits vulnerabilities.

Answer 5

Intrusive testing

Question 6

Passive does not exploit vulnerabilities and does not disrupt service.

Answer 6

Non-intrusive testing

Question 7

Done though it is inside the network and emulates an insider attack.

Answer 7

Credentialed

Question 8

A result that shows incorrectly that a condition or attribute is present. – false vulnerability

Answer 8

False positive

Question 8

Done as though it is outside the network and emulates an outside attack – shows what would be found if the network was scanned

Answer 8

Non-credentialed