You recently completed a vulnerability scan on your network. It reported that several servers are missing key operating system patches. However, after checking the servers, you've verified the servers have these patches installed. Which of the following BEST describes this?
False negative
Misconfiguration of servers
False positive
Servers not hardened
You suspect that a database server used by a web application does not have current patches. Which of the following is the BEST action to take to verify the server has up-to-date patches?
Vulnerability Scan
Port Scan
Protocol Analyzer
Host Enumeration
An organization has a legacy server within the DMZ. It is running older software that is not compatible with current patches, so it remains unpatched. Management accepts the risk on this system, but wants to know if attackers can access the internal network if they successfully compromise this server. Which of the following is the MOST appropriate test?
Code Review
Pentest
Testers do not have access to product documentation or any experience with an application. What type of test will they MOST likely perform?
Gray box
White box
Black box
Black hat
Your organization has hired a group of external testers to perform a black box penetration test. One of the testers asks you to provide information about your internal network. What should you provide?
A list of IP ranges and the types of security devices operational on the network
Network diagrams but without internal IP addresses
Access points to the network
Nothing
Some network diagrams and some IP addresses, but not all
Which of the following tools is the MOST invasive type of testing?
HIDS
Testers are analyzing a web application your organization is planning to deploy. They have full access to product documentation, including the code and data structures used by the application. What type of test will they MOST likely perform?
Gray Hat
Lisa recently an application to test the security posture of a database server running in a a test bed. What type of report will she retrieve to identify vulnerabilities that the application actually exploited?
Penetration test report
Vulnerability report
Risk assessment report
Code review report
Your organization outsourced development of a software module to modify the functionality of an existing proprietary application. The developer completed the module and is now testing it with the entire application. What type of testing is the developer performing?
