Section 25: Vulnerability Management

Question 1

Vulnerability Assessment vs Penetration Test

Answer 1

● Vulnerability Assessment
o Credentialed

● Penetration Test
o Non-credentialed

Question 2

Double-Blind Penetration Test

Answer 2

Double-Blind Test
▪ Much like the blind test, except the defenders are not informed about when the attack may occur

Question 3

Scope of Work (SOW)

Answer 3

▪ Details the tasks to be performed which will include all the rules of
engagement that will be followed

Question 4

Rules of Engagement (ROE)

Answer 4

▪ The ground rules both parties must abide by
● Timeline
● Location
● Time restrictions
● Transparency
● Boundaries
● Test Invasiveness

Question 5

Software Composition Analysis

Answer 5

▪ The assessor inspects the source code to try to identify any open source component