CS 205 Final Exam 2024 - Types of Security Testing and VM Lifecycle Steps

What is the main purpose of vulnerability assessment (VA) in security testing?

Which step in the VM lifecycle involves analyzing assets, examining IP subnets, and looking at potential network traffic issues?

What is the main goal of running a vulnerability scan in the VM lifecycle?

Which activity is NOT part of verifying (re-scanning) in the VM lifecycle?

What is a common feature of vulnerability scanners like Open VAS, Nessus, Qualys, and Rapid7?

In security testing, what distinguishes penetration testing (PT) from vulnerability assessment (VA)?

According to the given text, which team has primary ownership?

Who is responsible for testing patches in the environment based on the information provided?

In the context of the provided information, what does 'SCAP-validated vulnerability scanner' primarily scan for?

Which of the following is NOT a stage of Info sec Governance Block as outlined in the text?

From the details provided, which type of IT assets do not have a CIS/DISA STIG?

What activity will be required if 'Recourse and priority' falls under 'Mature' according to the text?

What is the purpose of checking the completeness and correctness of controls in the context of cyber security?

In the Cyber Security Maturity Matrix discussed, which level focuses on having Active Directory, Enterprise AV, and Windows OS licensed?

What is the difference between a remote exploit and a local exploit?

Why is it important to use only fully supported web browsers & email clients in an organization?

Which section of the Cyber Security Maturity Matrix focuses on having systems that are monitored regularly for threats?

What is the primary reason for ensuring the use of only fully supported browser & email clients according to the text?