IPA FE Subject A 2024 Question 9

Search for vulnerabilities and check whether the server can actually be intruded into — a penetration test attacks a system the way a real attacker would, to show which weaknesses can really be exploited.

With the owner’s permission, testers probe the public web server and the organization’s network for vulnerabilities such as unpatched software, open ports or weak settings, and then try to break in through them. The result shows not only that a weakness exists but whether it leads to an actual intrusion.

Answer (c)

Why not others:

• •(a) — examining the design documents and source code of each development phase with tools or by eye is a security review (static analysis, code review), done without attacking the running system
• •(b) — comparing stored hash values of the content files with newly generated ones is file integrity checking, which detects tampering with the web content
• •(d) — looking for abnormal traffic from each PC in IPFIX flow records is network behaviour monitoring, a detection measure, not an attack

Key rule: A penetration test actually attempts the intrusion to prove that a vulnerability can be exploited; reviews, integrity checks and traffic monitoring look for problems without attacking.

Security · AI-written, may contain errors