nerdexam
CompTIA

CAS-002 · Question #852

A security services company is scoping a proposal with a client. They want to perform a general security audit of their environment within a two week period and consequently have the following…

The correct answer is B. Perform dynamic code analysis, penetration test and run a vulnerability scanner. Each of the three audit requirements maps to a specific testing technique - vulnerability scanner for patch levels, dynamic code analysis for app/DB behavior, and penetration testing for data exfiltration.

Research and Analysis

Question

A security services company is scoping a proposal with a client. They want to perform a general security audit of their environment within a two week period and consequently have the following requirements:

Requirement 1 - Ensure their server infrastructure operating systems are at their latest patch levels Requirement 2 - Test the behavior between the application and database Requirement 3 - Ensure that customer data can not be exfiltrated Which of the following is the BEST solution to meet the above requirements?

Options

  • APenetration test, perform social engineering and run a vulnerability scanner
  • BPerform dynamic code analysis, penetration test and run a vulnerability scanner
  • CConduct network analysis, dynamic code analysis, and static code analysis
  • DRun a protocol analyzer perform static code analysis and vulnerability assessment

How the community answered

(42 responses)
  • A
    5% (2)
  • B
    57% (24)
  • C
    26% (11)
  • D
    12% (5)

Why each option

Each of the three audit requirements maps to a specific testing technique - vulnerability scanner for patch levels, dynamic code analysis for app/DB behavior, and penetration testing for data exfiltration.

APenetration test, perform social engineering and run a vulnerability scanner

Social engineering tests human susceptibility to manipulation and does not address OS patch levels, application-to-database behavior, or technical data exfiltration controls.

BPerform dynamic code analysis, penetration test and run a vulnerability scannerCorrect

A vulnerability scanner addresses Requirement 1 by identifying missing OS patches and outdated software versions. Dynamic code analysis (DAST) addresses Requirement 2 by executing the application at runtime and observing interactions between the application and the database. A penetration test addresses Requirement 3 by simulating real-world attacker behavior to verify that customer data cannot be extracted from the environment.

CConduct network analysis, dynamic code analysis, and static code analysis

Static code analysis reviews source code without execution and cannot test runtime application/database behavior; this option also omits a vulnerability scanner needed for patch assessment.

DRun a protocol analyzer perform static code analysis and vulnerability assessment

A protocol analyzer captures and inspects network traffic but does not assess patch levels; static code analysis cannot evaluate runtime application/database interactions required by Requirement 2.

Concept tested: Mapping security testing tools to specific audit requirements

Source: https://owasp.org/www-project-web-security-testing-guide/

Topics

#vulnerability assessment#penetration testing#dynamic code analysis#security audit methodology

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice