2B: Outline the Rules of Engagement

Question 1

An attacker’s ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Answer 1

Advanced Persistent Threat (APT)

Question 2

A type of assessment that is used as part of fulfilling the requirements of a specific law or standard, such as GDPR, HIPAA, or PCI DSS.

Answer 2

Compliance Based

Question 3

A type of assessment that uses two opposing teams in a PenTest or incident response exercise: the “attacking” team, and the “defending” team.

Answer 3

Red team/blue team-based

Question 4

A type of assessment that has a particular purpose or reason.For example, before implementing a new point of sale (PoS) system that accepts credit cards, the PenTesting team might test the system for any security issues prior to implementation.

Answer 4

Goals-based/objectives-based

Question 5

One of the three CompTIA strategy types for conducting a pentest, this type of testing is when the PenTesting team is completely in the dark; no information is presented to the team prior to testing.

Answer 5

Unknown Environment

Question 6

One of the three CompTIA strategy types for conducting a pentest, this type of testing is commonly used to test web applications for security vulnerabilities. The PenTesting team is given some information, such as internal functionality and code so they can focus on testing for any issues related to system defects or improper usage of applications. For example, a partially unknowntest might be run after any software defects are repaired.

Answer 6

Partially Known Environment

Question 7

One of the three CompTIA strategy types for conducting a pentest, this type of testing is when the PenTesting team is given all details of the network and applications.The test is commonly done with the perspective of the user.Because all of the details are transparent, the team can focus on the test.

Answer 7

Known Environment

Question 8

According to CompTIA, when the team meets with the stakeholders, they will determine the type of strategy they will take, along with how much information they are given prior to conducting the PenTest. What are the three CompTIA specified PenTesting strategies for conducting testing?

Answer 8

1. Unknown Environment
2. Partially Known Environment
3. Known Environment