Domain 6- Security Assessment and Strategy

Question 1

Penetration Testing Methodology

Answer 1

-Planning
Reconnaissance
-Scanning
-Vulnerability Assessment
-Exploitation
-Reporting

Question 2

Vulnerability Testing

Answer 2

-scans a network or system for a list of predefined vulnerabilities
.system misconfiguration
.outdated software
.lack of patching
-Results in a Common Vulnerability Scoring System (CVSS) score

Question 3

Security Assessment

Answer 3

-A holistic approach to accessing the effectiveness of security controls
-Where are the gaps in control, what are the applicable threats
-Broad scope
-Domains may include
.Administrative control (policies and procedures)
.Change management
. Architectural review
. Penetration test
.Vulnerability assessment
.Security Assessment

Question 4

Internal audits

Answer 4

Structured Audit

• external audience
• validate compliance, etc.

Unstructured audit

• internal audience
• to improve security

Question 5

3rd Party Audit

Answer 5

• Experts
• Add credibility
• Teach

Question 6

Log Review - Security Audit Logs

Answer 6

• a detective control
• Types of logs to collect
  .Network security hardware and software
  .Antivirus logs
  .IDS/IPS logs
  .Remote access software
  .web proxy
  .vulnerability management
  .authentication servers
  .routers and firewalls

Question 7

Software Testing Methods

Answer 7

-Static: test code passively, without running
-Dynamic: tests code while executing
-Black box: gives testers no internal details
-Traceability matrix or Requirements Traceability Matrix RTM: maps customers requirements to the software testing plan
Fuzzing: enters random, malformed data as inputs into software programs to determine of they will crash. (Black box)
Combinatorial: seeks to identify and test all unique combinations of software inputs (black box)

Question 8

Software Testing Levels

Answer 8

Unit Testing: test of software components (functions, objects, procedures)
Installation Testing: as software is installed and first operated
Integration Testing: testing multiple components as the are combines into a working system
Regression Testing: testing software after updates, modifications, or patches
Acceptance Testing: customer tests to ensure that software meets operational requirements