OSSTMM covers which topics?

• A. Web app vulnerabilities only
• B. Scoping, metrics, human security testing, and data network testing
• C. Password cracking methodologies
• D. Incident response procedures

Answer: (B)

OSSTMM is a security testing framework designed to be repeatable and quantitative, covering how a test is scoped, what metrics are collected, and different domains of testing, including human factors and data networks. This breadth—defining the test boundaries, measuring results with consistent metrics, testing how people contribute to security (human security testing), and evaluating data networks—best matches what OSSTMM covers. The other options focus narrowly on a single area (web apps), a specific technique (password cracking), or a procedural domain (incident response), none of which reflect the full OSSTMM scope.