03- Penetration Testing

Question 1

Acceptable use policy

Answer 1

how to use corporate systems and for what they are allowed to be used

Question 2

COPPA

Answer 2

Regulates the ways that website operators can interact with children under the age of 13

Question 3

Core Impact

Answer 3

guru in automated testing. It’s the tool that every penetration tester would love to own and use.

Question 4

External Testing

Answer 4

focused on the server’s infrastructure and underlying software pertaining to the target; can be performed with no prior knowledge of the site or with full disclosure of the topology and environment

Question 5

FERPA

Answer 5

Governs the handling and disclosure of student educational records by educational institutions

Question 6

GLBA

Answer 6

Requires that financial institutions develop and implement an information security program that is based upon a risk assessment and a formal written security plan

Question 7

hacking

Answer 7

Is, unfortunately, a loaded term that in some ways defies definition. Very simply, it is an intrusion upon a system. In some cases, as with Certified Ethical Hackers, this intrusion is solicited for the purposes of defining and ultimately resolving network vulnerabilities. Still, in others, hacking denotes unauthorized access. In some cases, the term “hacker” is used synonymously with “programmer”

Question 8

HIPPA

Answer 8

Requires that health care providers, health plans, and health care information clearinghouses follow a set of security and privacy standards for protected health information

Question 9

Internal testing

Answer 9

simulates what an insider attack could accomplish. The targets are the same as external pentesting, but the difference is the attacker either has authorized access or is starting from a point within the internal network.

Question 10

keylogger

Answer 10

Is a piece of software that secretly records all the keys pressed on a victims computer and then saves them to a log file. Some log files are sent automatically to the attacker or retrieved at a later date. Keystroke loggers can capture keystrokes, screenshots, and other activities on a computer. Keylogging software can be deployed to a computer by email, ftp, remote installation, or by plugging a small device (i.e. USB stick) into the back of a PC where the victim rarely looks

Question 11

Metasploit

Answer 11

presents a manual framework with a plugin “Armitage” to automate the pen-test.

Question 12

Nexpose

Answer 12

a sister tool to Metasploit; it is made by the same company, Rapid7

Question 13

PCI DSS

Answer 13

Regulates merchants and service providers involved in the storage, processing, and transmission of credit and debit card information

Question 14

Pen testers

Answer 14

Penetration tester; people who perform penetration testing, also called Ethical Hackers

Question 15

Penetration testing

Answer 15

Is also referred to as ethical hacking; however, the validity of the term “ethical hacker” is debated still today. The primary difference between penetration testing and vulnerability scanning is that penetration testing actually exploits a vulnerability and access to a target resource is obtained to prove without a doubt that the system or resource is vulnerable to attack. As with vulnerability scanning, penetration scanning should occur routinely and only with the permission of the owner whose systems and network are being targeted. Penetration testing can be carried out using a wide range of tools or with a vendor provided solution

Question 16

security assessment

Answer 16

where Security Policy Creation, Risk Identification, Vulnerability Scan, Vulnerability Assessment, Security Audit, and Penetration Testing are effectively used together to give the best result in order to secure an environment

Question 17

security audit

Answer 17

reviews the configuration of security controls (firewall, IDS, WAF, etc.)

Question 18

SOX

Answer 18

Governs the financial accounting practices of publicly traded companies and the implementation of security controls around systems that handle financially significant information

Question 19

Vulnerability

Answer 19

a weak link in the software, settings, etc., through which, if not fixed early, someone can get access to the computer, application, and/or network and can cause damage