GIAC
GCIH · Question #131
GCIH Question #131: Real Exam Question with Answer & Explanation
The correct answer is C: Vulnerability scanning. Vulnerability scanning is the highest priority when web application security is the stated concern because it directly identifies exploitable weaknesses in the applications themselves.
Question
You are the Security Consultant and have been hired to check security for a client's network. Your client has stated that he has many concerns but the most critical is the security of Web applications on their Web server. What should be your highest priority then in checking his network?
Options
- ASetting up IDS
- BPort scanning
- CVulnerability scanning
- DSetting up a honey pot
Explanation
Vulnerability scanning is the highest priority when web application security is the stated concern because it directly identifies exploitable weaknesses in the applications themselves.
Common mistakes.
- A. An IDS monitors traffic for known attack patterns in real time but does not identify pre-existing vulnerabilities in the web application code or configuration.
- B. Port scanning reveals which services are exposed but provides no information about the security posture or exploitability of the web application itself.
- D. A honeypot is a deception and intelligence-gathering mechanism used to study attacker behavior; it does not assess or remediate vulnerabilities in production web applications.
Concept tested. Web application security assessment methodology prioritization
Reference. https://owasp.org/www-project-web-security-testing-guide/
Community Discussion
No community discussion yet for this question.