2.3.4 Practice Questions Flashcards
Which of the following documents details exactly what can be tested during a penetration test?
answer
Non-Disclosure Agreement
Master Service Agreement
Rules of Engagement
Scope of Work
Scope of Work
Explanation
The scope of work is a very detailed document that defines exactly what software, and hardware, test types, and facility features are going to be included in the penetration test. This document is also referred to as the statement of work.
After performing a risk assessment, an organization must decide what areas of operation can be included in a penetration test and what areas cannot be included. Which of the following describes the process?
answer
Avoidance
Transference
Mitigation
Tolerance
Tolerance
Explanation
After a risk assessment is performed and vulnerable areas identified, the organization needs to decide their tolerance level
You are performing a penetration test of a local area network (LAN). Refer to the circled area on the network diagram. network. Which of the following types of penetration tests is being performed?
Black Box
Internal
External
Gray Bo
Internal
Explanation
An internal test will focus on any systems that logically resides behind the firewall
Miguel is performing a penetration test on a web server. Miguel was given only the server’s IP address and name. Which of the following best describes the type of penetration test Miguel is performing?
answer
White box
External
Internal
Black box
External
Explanation
An external test focuses on any publicly facing system, such as a web server that resides in the DMZ.
Which of the following elements is generally considered the weakest link in an organization’s security?
answer
Servers
Human
Network
Physical
Human
Explanation
It is commonly accepted that the weakest link in any security model is the human element
Which of the following best describes social engineering?
answer
The art of deceiving and manipulating others into doing what you want.
The process of analyzing an organization’s security and locating security holes.
Sending an email that appears to be from a bank to trick the target into entering their credentials on a malicious website.
A stealthy computer network attack in which a person or group gains unauthorized access for an extended period.
The art of deceiving and manipulating others into doing what you want.
Explanation
Social engineering is the art of deceiving and manipulating others into doing what you want.
Which of the following is considered a mission-critical application?
answer
Customer database
Support log
Medical database
Video player
Medical database
Explanation
Some applications are considered mission-critical and need to be off-limits to avoid any down time. This can include financial processing, medical databases, or other sensitive applications.
What does an organization do to identify areas of vulnerability within their network and security systems?
answer
Risk assessment
Scanning
External test
Internal test
Risk assessment
Explanation
The purpose of a risk assessment is to identify areas of vulnerability
During a risk assessment, the organization determines that the risk of collecting personal data from its customers is not acceptable and stops. What method of dealing with risk is the organization using?
answer
Transference
Mitigation
Avoidance
Acceptance
Avoidance
Explanation
When you identify a risk you can avoid, you should avoid it
The following formula defines which method of dealing with risk?
Cost of Risk > Damage = Risk _________
answer
Mitigation
Transference
Avoidance
Acceptance
Acceptance
Explanation
Risk acceptance occurs when the organization determines that the cost and effort to mitigate a risk outweighs the risk’s potential damage, so they simply accept the risk.
Which of the following is a consideration when scheduling a penetration test?
answer
Are there any security exceptions?
Who is aware of the test?
What risks are acceptable?
Which systems are being tested?
Who is aware of the test?
Explanation
The rules of engagement must specify who is aware of the penetration test and its time frame. The less people who know, the more realistic the test will be.
A client asking for small deviations from the scope of work is called:
answer
Change order
Scope creep
Security exception
Rules of engagement
Scope creep
Explanation
This is when the client begins asking for small deviations from the scope
Heather is in the middle of performing a penetration test when her client asks her to also check the security of an additional server. Which of the following documents does she need to submit before performing the additional task?
answer
Change order
Permission to test
Scope of work
Rules of engagement
Change order
Explanation
When a change to the scope of work is requested, a change order should be filled out and agreed on.
Which of the following is a deviation from standard operating security protocols?
answer
MAC filtering
Blacklisting
Whitelisting
Security exception
Security exception
Explanation
A security exception is any deviation from standard operating security protocols
Miguel is performing a penetration test. His client needs to add Miguel’s computer to the list of devices allowed to connect to the network. What type of security exception is this?
answer
Black box
White box
Blacklisting
Whitelisting
Whitelisting
Explanation
If a device is whitelisted, then traffic coming from it will be allowed through the IPS, Firewall, or network
