nerdexam
GIAC

GCIH · Question #131

You are the Security Consultant and have been hired to check security for a client's network. Your client has stated that he has many concerns but the most critical is the security of Web…

The correct answer is C. Vulnerability scanning. Vulnerability scanning is the highest priority when web application security is the stated concern because it directly identifies exploitable weaknesses in the applications themselves.

Web Application Attacks & Post-Exploitation

Question

You are the Security Consultant and have been hired to check security for a client's network. Your client has stated that he has many concerns but the most critical is the security of Web applications on their Web server. What should be your highest priority then in checking his network?

Options

  • ASetting up IDS
  • BPort scanning
  • CVulnerability scanning
  • DSetting up a honey pot

How the community answered

(33 responses)
  • A
    6% (2)
  • B
    18% (6)
  • C
    73% (24)
  • D
    3% (1)

Why each option

Vulnerability scanning is the highest priority when web application security is the stated concern because it directly identifies exploitable weaknesses in the applications themselves.

ASetting up IDS

An IDS monitors traffic for known attack patterns in real time but does not identify pre-existing vulnerabilities in the web application code or configuration.

BPort scanning

Port scanning reveals which services are exposed but provides no information about the security posture or exploitability of the web application itself.

CVulnerability scanningCorrect

Vulnerability scanning probes the web server and its applications for known CVEs, insecure configurations, injection flaws, and other OWASP Top 10 weaknesses, producing actionable findings that directly address the client's primary concern. Unlike passive or monitoring tools, a vulnerability scan actively maps the attack surface before an adversary can exploit it.

DSetting up a honey pot

A honeypot is a deception and intelligence-gathering mechanism used to study attacker behavior; it does not assess or remediate vulnerabilities in production web applications.

Concept tested: Web application security assessment methodology prioritization

Source: https://owasp.org/www-project-web-security-testing-guide/

Topics

#vulnerability scanning#web application security#security assessment#penetration testing methodology

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice