[Introduction to Incident Handling and Response] QualTech Solutions is a leading security services enterprise. Dickson works as an incident responder…

The scenario describes the use of automated tools to identify hosts, services, and vulnerabilities. This process involves actively sending probes, queries, and packets to the target systems and analyzing their responses. This direct interaction with the network is the defining characteristic of an active assessment. While the assessment could be internal or external, the methodology described is definitively active. Passive assessment, by contrast, would involve monitoring network traffic without directly engaging the target systems. Since the actions described are explicitly interactive, "Active assessment" is the most accurate classification.

A. Internal assessment: This is incorrect because the scenario does not specify Dickson's location. An internal assessment is performed from within the network perimeter, which is not stated.
C. Passive assessment: This is incorrect as the process involves using tools to "identify" hosts and services, which implies active probing, not passively sniffing traffic or analyzing logs.
D. External assessment: This is incorrect because, similar to internal assessment, the scenario provides no information about whether the scan originates from outside the organization's network.

1. National Institute of Standards and Technology (NIST) Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 4.2, Page 4-2. The document distinguishes between active and passive scanners: "Active scanners...interact directly with the target...by sending probes to the target and analyzing the feedback." This directly matches the actions described in the scenario.

2. Kim, D., & Solomon, M. G. (2016). Fundamentals of information systems security. Jones & Bartlett Learning. Chapter 7, "Security Operations," discusses vulnerability assessment types. It defines active scanning as directly probing systems for vulnerabilities, contrasting it with passive scanning, which analyzes traffic. The scenario clearly aligns with the definition of active scanning.

3. University of California, Berkeley. Information Security and Policy Courseware, "Vulnerability Scanning Service Definition." The documentation defines active scanning as a method that "sends traffic to a device to determine its operating system, services, and vulnerabilities." This aligns with Dickson's task of using automated tools to identify hosts, services, and vulnerabilities.