ECSA v10: EC-Council Certified Security Analyst v10

Question

Ross conducts a security test of his company’s network assets and produces a detailed report of every finding. In the report, he clearly describes the methodological approach he used to identify loopholes in the network. However, the report does not address exploitable security gaps or the amount of damage that could result from successfully exploiting the loopholes. It also does not specify remediation steps to secure the network.

What type of test did Ross perform?

Explanation

A security audit systematically examines security controls, processes, or compliance and documents the audit method and findings. It does not inherently require demonstrating exploitability, estimating the damage from a successful attack, or defining remediation actions; those elements are central to penetration testing, risk assessment, and vulnerability-management activities.

Learn more

NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

ECSA v10: EC-Council Certified Security Analyst v10

AstroTutor

Notes

Readiness

QuestionQ64

Community Discussion