Study. uk . com
  1. Home
  2. All questions
  3. Question 386

CISSP study material · question 386 of 500

A tester supplements automated scanning with manual vulnerability analysis. Which trade-off does SP 800-115 describe?

  1. Manual analysis is faster for large estates but produces more false positives.
  2. Manual analysis can find new or obscure weaknesses a scanner misses, but is much slower.
  3. Manual analysis is required by federal law wherever scanning is used.
  4. Manual analysis replaces the need for a vulnerability database entirely.
Show the answer

Answer: B. Manual analysis can find new or obscure weaknesses a scanner misses, but is much slower.

SP 800-115 says manual processes can identify new or obscure vulnerabilities that automated scanners may miss, but are much slower than an automated scanner.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 5.2.1 Penetration Testing Phases

Challenge yourself on this topic → Study as cards