Protection of Information Assets · Topic 7 of 8
Security Testing and Monitoring Tools
Vulnerability scanning, penetration test types, rules of engagement, SAST and DAST, and security monitoring with SIEM, IDS, honeypots and alert tuning.
- 3 min
- Scanning finds known weaknesses; pen testing proves exploitability.
- Credentialed scans see more; verify false positives.
- Black, gray and white box describe tester knowledge; double-blind also tests defenders.
What it is
Security testing checks whether controls actually resist attack, from automated scans for known weaknesses to skilled testers attempting to break in. Security monitoring watches systems and networks continuously so attacks and misuse are detected and acted on quickly.
How it works
Vulnerability assessment versus penetration testing
| Vulnerability scanning | Penetration testing | |
|---|---|---|
| Goal | Find known weaknesses broadly | Show whether weaknesses can be exploited and how far an attacker gets |
| Method | Automated tools | Skilled testers combining tools and manual techniques |
| Frequency | Regular, often continuous | Periodic and after major changes |
| Risk to systems | Low | Higher; needs careful planning |
Credentialed (authenticated) scans log in to systems and find more than unauthenticated scans. Scan results contain false positives that must be verified and can miss issues (false negatives). Findings are prioritized by severity, for example using CVSS scores, and by the importance of the asset.
Penetration test types
| Type | Tester knowledge |
|---|---|
| Black-box (blind) | No prior information, like an outside attacker |
| Gray-box | Partial information |
| White-box | Full information such as diagrams, code and credentials |
| Double-blind | Testers have no information and the defenders are not told, testing detection and response too |
Tests can be external or internal, and may include social engineering and physical intrusion.
Rules of engagement
Before any test: written authorization from management with the authority to approve it, a defined scope and time window, permitted techniques, contacts for emergencies, and handling rules for any data found. Testing without authorization is an attack.
Application security testing
| Technique | What it does |
|---|---|
| Static application security testing (SAST) | Analyzes source code without running it |
| Dynamic application security testing (DAST) | Tests the running application from outside |
| Code review | People examine code for flaws |
| Fuzzing | Sends malformed or random input to find crashes and errors |
Security monitoring tools
| Tool | Purpose |
|---|---|
| Security information and event management (SIEM) | Collects logs centrally, correlates events and raises alerts |
| IDS and IPS | Detect or block suspicious network traffic |
| Endpoint detection and response (EDR) | Monitors endpoint behavior |
| File integrity monitoring | Alerts when critical files change |
| Honeypot and honeynet | Decoy systems that attract attackers and reveal their methods |
| Security operations center (SOC) | Team that monitors alerts and responds |
Monitoring works only if use cases cover the important risks, alerts are tuned to keep false positives manageable, and someone investigates every significant alert within a set time.
When a SIEM generates thousands of alerts that nobody reviews, the finding is about tuning and response capacity, not about buying more monitoring tools.
How the exam asks about this
- "Which test shows whether a weakness can actually be exploited?" A penetration test.
- "What must exist before a penetration test starts?" Written authorization and agreed rules of engagement.
- "Which test checks both defenses and the SOC's response?" A double-blind test.
What to remember for the exam
- Scanning finds known weaknesses; pen testing proves exploitability.
- Credentialed scans see more; verify false positives.
- Black, gray and white box describe tester knowledge; double-blind also tests defenders.
- No test without written authorization and scope.
- SIEM correlates logs; alerts need tuning and owners.
Accepting a scan report's "no critical findings" without checking that all in-scope systems were actually scanned can hide untested systems.
Common mistakes
Treating a vulnerability scan as a penetration test.
Testing outside the authorized scope or window.
Collecting alerts without anyone responding.
Check yourself
What is the difference between SAST and DAST?
SAST analyzes source code without running it; DAST tests the running application.
What is a honeypot?
A decoy system designed to attract attackers and reveal their methods.
Why are credentialed scans more thorough?
They log in to systems and can inspect installed software and settings that unauthenticated scans cannot see.
Topic 7 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.