312-97 practice question 29 of 35

(Frances Fisher joined TerraWolt Pvt. Ltd. as a DevSecOps engineer in 2020. On February 1, 2022, his organization became a victim of cyber security…

(Frances Fisher joined TerraWolt Pvt. Ltd. as a DevSecOps engineer in 2020. On February 1, 2022, his organization became a victim of cyber security attack. The attacker targeted the network and application vulnerabilities and compromised some important functionality of the application. To secure the organization against similar types of attacks, Franches used a flexible, accurate, low maintenance vulnerability management and assessment solution that continuously scans the network and application vulnerabilities and provides daily updates and specialized testing methodologies to catch maximum detectable vulnerabilities. Based on the above-mentioned information, which of the following tools is Frances using?)

Answer options

A: SonarQube.

B: Black Duck.

C: BeSECURE. Correct answer

D: Shadow Daemon.

Correct Answer:

C. BeSECURE.

Explanation

The description points to a comprehensive vulnerability assessment and management solution that scans both network and application layers continuously. BeSECURE, by Beyond Security, is a platform that provides exactly these capabilities. It is designed for automated, continuous scanning of networks, web applications, and cloud infrastructure, offering daily updates to its vulnerability database. This aligns perfectly with the requirements for a flexible, accurate, and low-maintenance solution to catch a wide range of vulnerabilities.

Why Incorrect

A. SonarQube is a Static Application Security Testing (SAST) tool focused on code quality and security; it does not perform network vulnerability scanning.
B. Black Duck is a Software Composition Analysis (SCA) tool for managing vulnerabilities in open-source dependencies, not a network scanner.
D. Shadow Daemon is a Web Application Firewall (WAF) and RASP tool designed for real-time attack detection and prevention, not comprehensive vulnerability scanning.

References

1. Beyond Security. (n.d.). beSECURE (AVDS) Vulnerability Assessment & Management. Retrieved from https://www.beyondsecurity.com/besecure-vulnerability-assessment-management. The official product page states, "beSECURE is a vulnerability assessment and management platform that delivers accurate, prioritized, and actionable results for your network, web, application, and cloud assets."

2. Synopsys. (n.d.). Software Composition Analysis with Black Duck. Retrieved from https://www.synopsys.com/software-integrity/software-composition-analysis-tools.html. The official page describes Black Duck's function as identifying and managing open-source risks.

3. SonarSource. (n.d.). Clean Code | SonarQube. Retrieved from https://www.sonarsource.com/products/sonarqube/. The official site describes SonarQube as a static code analysis tool.

Keep practicing

Take the free 312-97 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test