Computer Science · Cyber Security

Consider the following statements regarding cyber security practices in financial institutions: Statement 1: A Vulnerability Assessment (VA) is a systematic review of security weaknesses in an information system that identifies potential gaps but does not involve active exploitation of those gaps to confirm their severity. Statement 2: Penetration Testing (PT) goes a step further by simulating a real-world cyber attack where a security professional attempts to exploit identified vulnerabilities to determine the actual depth of the risk. Statement 3: The Reserve Bank of India mandates that all banks must conduct a comprehensive VAPT audit once every five years to ensure systems are secure. Statement 4: A 'Red Team' exercise is an advanced form of security assessment where the team tests the bank's entire defensive capability, including people and processes, often without prior warning. Statement 5: 'Patch Management' is the process of updating software to fix security flaws, mitigating attacks that exploit known vulnerabilities. Statement 6: 'Zero-day Vulnerabilities' are security flaws that are known to the software vendor and have a patch available, but the bank has chosen not to install the patch. Statement 7: A Web Application Firewall (WAF) is specifically designed to protect internet-facing applications like online banking portals from attacks such as SQL Injection and Cross-Site Scripting. Which combination of statements is correct?