Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA PenTest+ > Domain 1: Planning and Scoping > Flashcards

Domain 1: Planning and Scoping Flashcards

1
Q

What are the 6 overall steps in the PenTest process?

A
  1. Planning and Scoping
  2. Information Gathering
  3. Vulnerability Analysis
  4. Explotation
  5. Post Exploitation
  6. Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What phase do the bellow happen in a Penetration Test?:

  • Discuss with the client their requirements for the test
  • Define the scope
A

Planning and Scoping Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Risk?

A

The proability that a threat will be realised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Vulnerability?

A

Any weakness in a systems design or implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Threat?

In relation to IT Security

A

Anything that could cause harm, loss, damage or compromise to IT systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where does Risk exsist?

A

When there is an overlap between vulnerability and threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of risk occurs when risk is identified but no mitigation factors are applied?

A

Inherent Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Residule Risk?

A

Occurs when risk is calculated after applying mitigations and security controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What type of risk is created due to a security exemption being granted or failure to comply with corporate policy?

A

Risk Exception

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What type of risk is?:

▪ Stops a risky activity or chooses a less risky alternative

▪ Eliminates the hazards, activities, and exposures with potential negative
effects

A

Risk Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Risk Transfer?

A

Passes the risk to a third party, such as an insurance company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is it when you accepts the current level of risk and the costs associated with it if that Risk were realized?

A

Risk Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Risk Appetite?

A

▪ The amount of risk an organization is willing to accept in pursuit of its
objectives
▪ Also called risk attitude and risk tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Risk Tolerance?

A

Specific maximum risk the organization is willing to take
about a specific identified risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are these:

  1. Compensative
  2. Corrective
  3. Detective
  4. Deterrent
  5. Directive
  6. Preventitive
  7. Recovery
A

Seven type of security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Corrective controls?

A

● Reduces the effect of an undesirable event or attack
● Examples: fire extinguishers and antivirus solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What type of controls are:
.● Used in place of a primary access control measure to mitigate a given risk

● Example: dual control

A

Compensative Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What type of controls are:

● Detects an ongoing attack and notifies the proper personnel

● Examples: alarm systems, closed circuit television systems, and
honeypots

A

Detective Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are Deterrent controls?

A

● Discourages any violation of security policies, both by attackers
and insiders
● Example: surveillance camera sign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What type of controls are:

● Forces compliance with the security policy and practices within the organization
● Example: Acceptable Use Policy (AUP)

A

Directive Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What type of controls:

● Prevents or stops an attack from occurring

● Examples: password protection, security badges, antivirus
software, and intrusion prevention systems

A

Preventive Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What type of controls are:

● Recovers a device after an attack
● Examples: Disaster Recovery Plans (DRPs), backups, and continuity
of operations plans

A

Recovery Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the three broad catagories which covers controls?

A
  • Administrative (Managerial)
  • Logical (Technical)
  • Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What type of controls:
● Manages personnel and assets through security policies, standards, procedures, guidelines, and baselines

● Examples: proper data classification and labeling, supervision of
personnel, and security awareness training

A

Administrative Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
What type of controls are: ● Implemented through hardware or software and used to prevent or restrict access to a system ● Examples: firewalls, intrusion detection systems, intrusion prevention systems, authentication schemes, encryption, new protocols, auditing or monitoring software, and biometrics
Logical Controls
24
Whats the difference between an Audit and Monitoring?
An Audit is a point in time evaluation whilst Monitoring is a ongoing process
25
What includes: ● Change management ● Configuration management ● Log monitoring ● Status report analysis
Continues Monitoring
26
What type of controls: ● Protects the organization’s personnel and facilities ● Examples: fences, locks, security badges, proximity cards for entry into the building, guards, access control vestibules, biometrics, and other means of securing the facility
Physical Controls
27
What type of methodology does: ▪ The systematic approach a pentester uses before, during, and after a penetration test, assessment, or engagement ▪ Penetration tests use the same steps taken by threat actors or hackers
Pentest Methodology
28
What are the 4 stages of the CompTIA PenTest+ methodology?
29
What is the name of NIST's PenTest methodology?
NIST SP 800-115
30
What are the steps of the EC Council CEH PenTest methodology?
31
What is Adversary Emulation?
Mimicing the tackticks, techniques and proceedures (TTP's) of a real worl threat actor in a penetration test.
32
Why is it good to have a proper scoping process?
It ensures a cost effective penetration test.
33
How do you narrow the scope of a penetration test?
Confirm the goals and objectives.
34
What are the three things that can blur the lines for a penetration tester?
* Wireless Local Area Network * VPN Connections * Cloud Migrations
35
What is it important to identify in terms of assets for a penetration test?
web and mobile applications
36
What are the six types of Threat Actors?
1. Script Kiddies 2. Insider Threat 3. Competitor 4. Organised Crime 5. Hacktivist 6. Nation State / Advanced Persistant Threat (APT)
37
What is a Script Kiddie? | Threat Actor
The least skilled Threat Actor, who uses freely available tools on the internet or in openly available security toolsets that security penetration testers might also use.
38
What is an Insider Threat? | Threat Actor
A Threat Actor with authorized access to an organisations network, policies, proceedures and business practices.
39
What types of things protect against Insider Threat?
* Data Loss Prevention (DLP) * Internal Defenses * SIEM
40
What is a Competitor? | Threat Actor
A rogue business that attempts to conduct cyber espionage against an organization.
41
What is an Organised Crime Threat Actor? | Threat Actor
A catagory of threat actor that is focused on hacking and computer fraud in order to receive finanical gain. ## Footnote Usually well funded and can use sophisticated tools.
42
What is a Hacktivist? | Threat Actor
Politically motivated hacker who targets governments, corporations and individuals to advance their own political ideologies and agendas.
43
What is a Nation State / Advanced Persistant Threat (APT)? | Threat Actor
A group of attackers with exceptional capability, funding and organization with an intent to hack a network or system.
44
What doe Nation State / ATP threat actors do?
Conduct highley covert attacks over long periods of time
45
What are False Flag operations?
When the TTP's of other Threat Actors are used to shif t the blame to them.
46
As a Penetration Tester, what do you need to develop to imitate Nation State / ATP Threat Actors?
Developing your own custom code and exploits.
47
What do Tier 1 Catagory Threat Actors do?
Have little money and rely on off-the-shelf tools and know exploits.
48
What catogorises a Threat Actor as Tier 2?
they have a little money but have invested in their own tools against known vulnerabilities.
49
What catogorises a Threat Actor as Tier 3?
They invest a lot of money to find unknown vulerabilities in order to make a profit.
50
What catogorises a Threat Actor as Tier 4?
They are organised, highly technical, proficient and well funded hackers, working in teams to develop new exploits.
51
What catogorises a Threat Actor as Tier 5?
Invests lots of money to create vulerabilities and exploits.
52
What catogorises a Threat Actor as Tier 6?
They invest even more money to carry out cyber attacks and military and inteligence operations to achieve political, military and economic goals.
53
What should the target list include?
* Internal and External targets * First or Third Party targets
54
What is an Internal Target?
The target is inside the organizations firewall and requires testers to be on site or gain access through a VPN, or exploit a users computer inside the organisations network.
55
What is an External Target?
The target can be accessed directly across the internet. The target organisation must be informed if allowed to attack first-party hosted servers only or assets hosted by a third-party.
56
What is a Physical Security assessment?
A target site at a location is tested by the penetration tester for physical access or some other goals.
57
What is an On-Site Asset?
Any asset that is physically located where an attack is being carried out.
58
Whats is an Off-Site Asset?
Any asset that provides a service for a company not necessiary located at the same place.
59
What is the easiest attack vector for a Penetration Test?
Users
60
What do you have to confirm when the Wireless Networks are in scope?
* Which SSID's are in and out of scope * Which assets are in scope by IP Address or ranges, Associated Domans and Sub Domans and DNS Servers.
61
What is an Autonomous System Number (ASN)?
A unique identifier that defines a group of one or more IP Prefixes run by one or more network operators that maintain a single clearly-defined routing policy.
62
What is scope creep?
Occurs when a client starts asking for more services than what is listed in the statement of works.
63
What do you need to do if additional work is requested?
* Make an addendum to the contract and add it to the scope of works and master contract * Pre-arrange cost for expansions
64
What must you do before commencing a penetration test after a scope is agreed?
Consult with lawyer / solicitor before accepting a contract and ensure you can legally perform the service.
65
Why must you be careful what penetration tools are used durign the engagement?
Some tools can be considered as survalienance tools in some countries. ## Footnote See Wassenaar Agreement
66
Whate are Rules of Engagement?
The ground rules that both the organization and the penetration tester must obide by.
67
What are the five main features of a the Rules of Engagement?
1. Timeline 2. Locations 3. Time Restrictions 4. Transparency 5. Boundaries
68
What does the Timeline specify in the Rules of Engagement?
* When the test will occur * Total time of engagement * Penetration Team will estimate which tasks will need performing and how long it'll take. * Should include who is responsible for performing a task
69
What should be specified under the locations in the Rules of Engagement?
All authorised locations, especially those across international borders.
70
Where in the Rules of Engagement is the trusted agent specified?
Under the transparency section.
71
Who provides the penetration tester with the resources from the target side?
The Trusted Agent.
72
What does the Boundaries specifiy in the Rules of Engagement?
What systems may be targeted and what techniques can be utilized.
73
What is a Compliance-Based Assessment?
A type of assessment that focuses on finding out if policies and regulations are being properly followed. The tester can use a checklist against the specific compliance to make sure the target is compliant.
74
What is a Pre-Merger Assessment?
A type of assessment that is conducted before two companies merge with each other in a period of time known as due dilligence.
75
What is an Unknown Environment assessment?
An assessment where the penetration tester has no prior knowledge of the target organisation or their network. The tester will spend a lot of time in information gathering and vulnerability scanning phases.
76
What is a partially known environment assessment?
The most common type of assessment which entails partial knowledge of the target organization and its information systems.
77
What should be done when validating the scope?
* Confirm all requirements * Confirm backup and recovery status * Who to contact when something goes wrong. * Review all areas of the Scope of Works and Rules of Engagement.
78
What could happen if there is an unauthorized disclosure of information?
Your company may be liable.
79
WHat can you do to protect yourself and your company before the penetration test has started?
Include liability wavers in the documentation.

CompTIA PenTest+ (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions