Issues with Open Source Tools CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A security team wants to integrate an open source scanning tool into their existing CI/CD pipeline. Which of the following is a common integration challenge?

   • AThe tool cannot be run from the command line
   • BThe tool requires a specific operating system that the team does not use
   • CThe tool is too expensive to license
   • DThe tool has too many features
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is using an open source web application scanner to test a large e-commerce platform. The scanner runs on a single virtual machine and is taking over 48 hours to complete a full scan, which is delaying the release cycle. The team needs to reduce scan time without changing the scope of the test. What should the team do?

   • ARun the scan during off-peak hours to avoid network contention.
   • BReduce the scan depth and disable some checks to speed up the scan.
   • CUpgrade the virtual machine to a larger instance with more CPU and memory.
   • DDistribute the scan across multiple virtual machines by splitting the target URL list.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes a sign of poor community health in an open source security testing tool project?

   • AA large number of open issues with no responses from maintainers
   • BA well-documented user manual
   • CA code of conduct for contributors
   • DRegular releases with version numbers
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is using an open source vulnerability scanner that has a known limitation: it does not support authentication for web application scans. The team needs to test an authenticated area of a web application. The scanner's documentation is sparse, and the maintainers have not responded to questions about this feature. What is the most effective way to proceed?

   • APerform manual testing of the authenticated area and use the scanner only for unauthenticated areas.
   • BUse a different open source scanner that supports authentication, and supplement it with the current scanner for other tests.
   • CWait for the maintainers to add authentication support in a future release.
   • DAttempt to modify the scanner's source code to add authentication support.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration testing team uses an open source network scanner that outputs results in a proprietary XML format. The team's reporting tool only accepts JSON. The team has tried to configure the scanner to output JSON, but the feature is not implemented. What is the most effective way to integrate the scanner into the existing reporting workflow?

   • ASwitch to a different open source scanner that natively supports JSON output.
   • BManually copy the scan results from the XML file into the reporting tool.
   • CDevelop a small conversion script to transform the XML output into the JSON format required by the reporting tool.
   • DAsk the reporting tool vendor to add XML import support.
   Reveal Solution Discussion Select an answer first