Vulnerabilities are classified based on:
a) severity level (high, medium, low)
b) exploit range (local or remote)
c) all of the above
c) all of the above
When will an administrator need vulnerability research?
a) to gather info regarding trends, threats, attack surfaces, attack vendors, techniques
b) gather info to aid in prevention of security issues
c) to know how to recover from a network attack
d) to discover weaknesses in the OS and applications and alert the network administrator before a network attack
e) all of the above
e) all of the above
What is vulnerability assessment?
An in-depth examination of the ability of a system or application, including security procedures and controls, to withstand the exploitation.
It recognizes, measure and classifies security vulnerabilities in a computer system, network and communication channels.
What type of info can be obtained from a vulnerability scanner?
a) network vulnerabilities
b) open ports and running services
c) application and services vulnerabilities
d) application and services configuration errors
e) all of the above
e) all of the above
What is the Vulnerability-Management life cycle?
- Identify Assets and create a baseline
- Vulnerability scan
- Risk Assessment
- Remediation
- Verification
- Monitor
What can vulnerabilities be classified under?
- Misconfiguration
- Default installations
- Buffer overflows
- Unpatched servers
- Design Flaws
- OS flaws
- Application flaws
- Open services
- Default passwords
What types of vulnerability assessments are there?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
Uses a network scanner to find hosts, services and vulnerabilities is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Active Assessment
Scans the internal infrastructure to discover exploits an vulnerabilities is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Internal Assessment
Determines possible network security attacks that may occur on the organization’s system is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Network-based Assessment
Used to sniff the network traffic to discover present active systems, network services, applications, and vulnerabilities present is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Passive Assessment
Focuses on testing databases, such as MYSQL, MSSQL, ORACLE, POSTGRESQL, etc., for the presence of data exposure or injection type vulnerabilities is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Database assessment
Assess the network form a hacker’s perspective to discover exploits and vulnerabilities that are accessible to the outside world, is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- External Assessment
Conducts a configuration-level check to identify system configurations, user directories, file systems, registry settings, etc., to evaluate the possibility of compromise, is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Host-based Assessment
Tests and analyzes all elements of the web infrastructure for any misconfigurations, outdated content, or known vulnerabilities, is an example of what kind of vulnerability assessment?
- Active Assessment
- Passive Assessment
- External Assessment
- Internal Assessment
- Host-based Assessment
- Network-based Assessment
- Application Assessment
- Database Assessment
- Application Assessment
Name a vulnerability assessment tool.
OpenVAS
Nikto
What type of information do vulnerability assessment reports contain?
a) disclosing the risks detected after scanning a network
b) the report alerts the organization of possible attacks and suggests countermeasures
c) info available in the reports is used to fix security flaws
d) all of the above
d) all of the above
What 3 key pieces of information are listed in a vulnerability assessment report?
scan info
target info
results
