For public-facing web applications, which method is acceptable to address known attacks?

• A. Rely solely on external vulnerability scans performed quarterly
• B. Perform vulnerability assessments only when a problem is reported
• C. Install a host-based firewall and ignore vulnerability assessments
• D. At least annually, review public-facing apps using manual or automated vulnerability assessment tools

Answer: (D)

Regularly testing public-facing web applications for vulnerabilities is essential to reduce exposure to known attacks. Relying only on quarterly external vulnerability scans won’t catch every weakness, especially those that arise after code changes or internal configurations, and waiting for a problem to be reported is a reactive approach that leaves exploitable flaws unaddressed. A host-based firewall helps border control but won’t identify application-layer flaws or misconfigurations attackers can exploit to gain access.

The best approach is to perform at least an annual review of public-facing applications using a mix of manual and automated vulnerability assessment tools. Automated scanners quickly uncover common vulnerabilities and misconfigurations across the surface, while manual testing provides deeper insight into logic flaws, access controls, and complex workflows that automation alone may miss. This combination proactively identifies and prioritizes remediation before attackers can exploit known weaknesses, aligning with the goal of addressing known attacks.