Issues with Open Source Tools CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team relies on an open source vulnerability scanner that has a known limitation: it does not detect vulnerabilities in custom web applications. The team needs to ensure comprehensive coverage. What is the most effective way to mitigate this limitation?

   • ASwitch entirely to a commercial scanner that covers both standard and custom web applications.
   • BSupplement the open source scanner with a commercial scanner that specializes in custom web application testing.
   • CAccept the limitation and rely on manual testing for custom web applications.
   • DModify the open source scanner's source code to add custom web application detection.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is evaluating two open source vulnerability scanners. Scanner A has a large community, frequent releases, and a responsive issue tracker. Scanner B has a smaller community, infrequent releases, and a backlog of unresolved issues. Both tools have similar features and detection capabilities. What is the most important factor for the team to consider when choosing between the two?

   • AThe tool's popularity on social media and online forums.
   • BThe number of features the tool offers, since more features are always better.
   • CThe long-term reliability and sustainability of the tool, as indicated by its community health and maintenance activity.
   • DThe initial cost of the tool, since open source tools are free to use.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security tester is evaluating an open source vulnerability scanner for use in a corporate environment. Which of the following is a typical limitation of open source security testing tools?

   • AThey cannot be customized or extended by users
   • BThey are not suitable for any security testing purpose
   • CThey often lack formal vendor support and may have incomplete documentation
   • DThey are always less accurate than commercial tools
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is considering adopting an open source security testing tool. The tool has a large number of stars on GitHub, but the last commit was over two years ago, and the issue tracker has many unresolved issues. The team needs a reliable tool for a long-term project. What is the most important factor to consider in this decision?

   • AThe tool's licensing, since a permissive license is always preferable.
   • BThe tool's feature set, since a tool with more features is more likely to meet the team's needs.
   • CThe tool's compatibility with the team's existing infrastructure, since integration is critical.
   • DThe tool's actual maintenance activity, such as the frequency of commits and the responsiveness of maintainers, rather than its popularity.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team has adopted an open source vulnerability scanner for its CI/CD pipeline. The tool was popular six months ago, but the maintainers have not merged any pull requests or responded to issues for three months. The team is now seeing false positives that the tool's documentation does not explain. What should the team do first to address the tool's reliability?

   • AImmediately replace the tool with a commercial alternative to avoid further false positives.
   • BEvaluate the project's community health and update frequency to determine if the tool is still viable.
   • CWrite a custom script to filter out the false positives from the scanner's output.
   • DContact the maintainers directly via email to request a fix for the false positives.
   Reveal Solution Discussion Select an answer first