2.0 Vulnerability Management Flashcards
(110 cards)
1
Q
Map scans
A
2
Q
Device fingerprinting
A
3
Q
Scheduling
A
4
Q
Operations
A
5
Q
Performance
A
6
Q
Sensitivity levels
A
7
Q
Segmentation
A
8
Q
Regulatory requirements
A
9
Q
Internal vs. external scanning
A
10
Q
Agent vs. agentless
A
11
Q
Credentialed vs. non-credentialed
A
12
Q
Passive vs. active
A
13
Q
Static vs. dymanic
A
14
Q
Reverse engineering
A
15
Q
Fuzzing
A
16
Q
Operational technology (OT)
A
17
Q
Industrial control systems (ICS)
A
18
Q
Supervisory control and data acquisition (SCADA)
A
19
Q
Security baseline scanning
A
20
Q
Payment Card Industry Data Security Standard (PCI DSS)
A
21
Q
Center for Internet Security (CIS) benchmarks
A
22
Q
Open Web Application Security Project (OWASP)
A
23
Q
International Organization for Standardization (ISO) 27000 series
A
24
Q
Angry IP Scanner
A
25
Maltego
26
Burp Suite
27
Zed Attack Proxy (ZAP)
28
Arachni
29
Nikto
30
Nessus
31
OpenVAS
32
Immunity debugger
33
GNU debugger (GDB)
34
Nmap
35
Metasploit framework (MSF)
36
Recon-ng
37
Scout Suite
38
Prowler
39
Pacu
40
Common Vulnerability Scoring System (CVSS) Interpretation
41
Attack vectors
42
Attack complexity
43
Privileges required
44
User interaction
45
Scope
46
Impact
Confidentiality
Integrity
Availability
47
True/false positives
48
True/false negatives
49
Internal
50
External
51
Isolated
52
Exploitability/weaponization
53
Asset value
54
Zero-day
55
Cross-site scripting
56
Reflected
57
Persistent
58
Buffer overflow
59
Integer overflow
60
Heap overflow
61
Stack overflow
62
Data poisoning
63
Broken access control
64
Cryptographic failures
65
Injection flaws
66
Cross-site request forgery
67
Directory traversal
68
Insecure design
69
Security misconfiguration
70
End-of-life or outdated components
71
Identification and authentication failures
72
Server-side request forgery
73
Remote code execution
74
Privilege escalation
75
Local file inclusion (LFI)/remote file inclusion (RFI)
76
Compensating control
77
Managerial
78
Operational
79
Technical
80
Preventative
81
Detective
82
Responsive
83
Corrective
84
Testing
85
Implementation
86
Rollback
87
Validation
88
Maintenance windows
89
Exceptions
90
Accept
91
Transfer
92
Avoid
93
Mitigate
94
Policies, governance, and service level objectives (SLO)
95
Prioritization and escalation
96
Edge discovery
97
Passive discovery
98
Security controls testing
99
Penetration testing and adversary emulation
100
Bug bounty
101
Attack surface reduction
102
Input validation
103
Output encoding
104
Session management
105
Authentication
106
Data protection
107
Parameterized queries
108
Secure software development life cycle (SDLC)
109
Threat modeling
110
