312-50 Question 114
Single answer▪ Vulnerability Assessment ConceptsA retail company asks a CEH consultant to perform a vulnerability assessment of its external web application environment before a seasonal sales event. The company wants to identify exploitable weaknesses quickly, but the application must remain available to customers during business hours. During planning, the consultant discovers that one scanner profile performs safe checks such as banner grabbing, TLS configuration review, and version-based vulnerability correlation, while another profile includes intrusive tests that may attempt exploitation or cause service instability. Which approach is the MOST appropriate for this engagement?
- A
Run the intrusive profile immediately against production during business hours to uncover the highest number of vulnerabilities in a single pass
- B
Use the safe, non-intrusive assessment profile on the production environment during business hours, then schedule intrusive validation for an approved maintenance window if needed
- C
Skip automated scanning and rely only on manual password guessing against the login portal to avoid false positives
- D
Perform a full penetration test without prior authorization because vulnerability assessments do not require formal scope approval
Show answer and explanation
Correct answer: B
Explanation
The best answer is to start with a safe, non-intrusive scan in production and defer any intrusive validation to an approved maintenance window. In vulnerability assessment, the tester must balance coverage, accuracy, and operational risk. Production systems that must remain available are typically assessed first with safe checks such as service discovery, version detection, configuration review, and correlation against known vulnerabilities. Intrusive or exploit-like checks can increase confidence in findings, but they also raise the chance of service degradation and therefore should be explicitly authorized and carefully scheduled. This distinction is consistent with common security assessment methodology and vendor guidance for enterprise scanners, which often separate safe checks from potentially disruptive plugins. It also aligns with core CEH concepts: obtain authorization, define scope, minimize business impact, and choose the assessment technique that matches the engagement objective.
- A. Incorrect.
This is incorrect because intrusive scanning on a live production system during business hours can negatively affect availability and may violate the customer's requirement to keep the application stable for customers. In vulnerability assessment, scan safety and operational impact are key planning factors. Intrusive checks may be useful later, but only with explicit approval and appropriate scheduling.
- B. Correct.
This is correct because it aligns the assessment method with the business constraint of maintaining availability. Safe or non-intrusive vulnerability scans are commonly used first in production to identify likely weaknesses with lower risk of disruption. If deeper validation is necessary, intrusive checks or exploit attempts should be separately approved and scheduled in a maintenance window. This reflects standard vulnerability assessment practice: choose the least disruptive method that still meets objectives.
- C. Incorrect.
This is incorrect because limiting the assessment to manual password guessing is not a vulnerability assessment strategy for the stated goal. It is too narrow, introduces unnecessary authentication attack activity, and would miss many common issues such as outdated software, weak TLS settings, exposed services, and known CVEs. It also does not meaningfully address the requirement for broad weakness identification.
- D. Incorrect.
This is incorrect because both vulnerability assessments and penetration tests require formal authorization, defined scope, and rules of engagement. Conducting testing without prior approval is unethical and can be unlawful. In addition, a penetration test is not the same as a vulnerability assessment; the former focuses more on exploitation and impact validation, while the latter focuses on identifying and prioritizing weaknesses.