Security Assessment and Testing
Core concepts
Know the assessment types: vulnerability scanning (identify weaknesses), penetration testing (exploit to prove impact), audit (verify against criteria), and code review. Understand test methodologies (black-box, white-box, gray-box) and that scope and rules of engagement must be authorized in writing before testing. Know false positive vs false negative and that tuning reduces noise but can hide real issues.
Metrics and coverage
Understand coverage and sampling: you cannot test everything, so risk-based sampling matters. Know the difference between synthetic and real monitoring, and that log review and SIEM correlation are detective controls. Understand that a scan without remediation has little value - the finding lifecycle is identify, prioritize, remediate, verify, and close.
Traps
A common trap is treating a vulnerability scan as a penetration test - scanning does not exploit. Another is assuming a clean scan means no vulnerabilities (false negatives, unknown CVEs). Watch for questions about who authorizes testing - written authorization from the asset owner is required. Also, be careful with "first step" questions: for a new assessment, the first step is usually defining scope and objectives, not running tools.
Worked example
A scan reports a critical finding on a production server. The correct sequence is to validate the finding (rule out false positive), assess business impact, then remediate per change management - not to immediately patch during peak hours, which risks availability.