CAS-003 · Question #19
A security controls assessor intends to perform a holistic configuration compliance test of networked assets. The assessor has been handed a package of definitions provided in XML format, and many…
The correct answer is D. XML fuzzer. NOTE: The listed correct answer (D - XML fuzzer) appears to be incorrect. The XML tags '<object object_ref=... />' and '<state state_ref=... />' are characteristic of OVAL (Open Vulnerability and Assessment Language), which is a core component of SCAP (Security Content…
Question
A security controls assessor intends to perform a holistic configuration compliance test of networked assets. The assessor has been handed a package of definitions provided in XML format, and many of the files have two common tags within them: "<object object_ref=... />" and "<state state_ref=... />". Which of the following tools BEST supports the use of these definitions?
Options
- AHTTP interceptor
- BStatic code analyzer
- CSCAP scanner
- DXML fuzzer
How the community answered
(54 responses)- A13% (7)
- B6% (3)
- C4% (2)
- D78% (42)
Explanation
NOTE: The listed correct answer (D - XML fuzzer) appears to be incorrect. The XML tags '<object object_ref=... />' and '<state state_ref=... />' are characteristic of OVAL (Open Vulnerability and Assessment Language), which is a core component of SCAP (Security Content Automation Protocol). OVAL uses precisely these constructs - object elements to define what system artifact to check, and state elements to define the expected/compliant value. A SCAP scanner (C) is specifically designed to ingest OVAL/XCCDF definition packages and evaluate whether networked assets meet those configuration baselines, making it the correct tool for a holistic configuration compliance test. An XML fuzzer (D) is a security testing tool used to discover vulnerabilities in XML parsers by sending malformed or unexpected input - it has no role in compliance scanning. The correct answer should be C.
Topics
Community Discussion
No community discussion yet for this question.