IS3230 CHAPTER 14 Flashcards
The use of software to control the execution of a test suite is called ___.
AUTOMATED TESTING
A hole in system or network security placed deliberately either by system designers or attackers and also a way of quickly bypassing normal security measures is called ___.
BACKDOOR
In a penetration test, the ___ consists of IT staff who defend against the penetration testers. They are generally aware that a penetration test is happening but do not know what methods the penetration testers will user.
BLUE TEAM
The outermost extremes of test conditions is called ___.
BOUNDARY CONDITIONS
An industry mailing list provided by Symantec that reports new vulnerabilities as they are discovered is called ___.
BUGTRAQ
An attack in which malicious code is introduced into an application. This type of attack is possible because of lax input validation in the target application and is called ___.
CODE INJECTIONS
A document that defines every data element and database table in a piece of software is called ___.
DATA DICTIONARY
.The process of identifying the difference between reality–the current state of an organization’s IT infrastructure–and the organization’s security goals is called ___.
GAP ANALYSIS
The authorization memo, signed by a member of upper management, that states that a penetration test has been authorized and exactly what methods the test will include. Every member of a penetration testing team should carry a copy of this memo at all time to avoid misunderstandings with security and law enforcement and is called ___.
GET OUT OF JAIL FREE CARD
The process by which vulnerabilities are addressed to create a secure system is called ___.
HARDENING
The process of scanning the network to find out which Internet Protocol (IP) addresses are attached to interesting resources is called ___.
HOST DISCOVERY
The process of testing how individual components function together as a complete system is called ___.
INTEGRATION TESTING
Security testing methods that expo it possible vulnerabilities in order to prove their existence and potential impact is called ___.
INTRUSIVE TESTING METHODS
A way of measuring how software will perform with an average number of user, as well as how it will perform under extreme load conditions is called ___.
LOAD TESTING
A proprietary security scanner developed by Tenable Network Security. It is network-centric with Web-based consoles and a central server is called ___.
NESSUS
An open source port scanning and host detection utility is called ___.
NMAP
.Security testing methods that do not exploit possible vulnerabilities is called ___.
NONINTRUSIVE TESTING METHODS
The act of simulating an attack on an organization’s resources to assess an infrastructure’s true vulnerability. This is an actual attack where testers use a variety of methods including social engineering, software hacking, and physical intrusion and is called ___.
PENETRATION TESTING
A technique designed to probe a networks’s open ports looking for a weakness is called ___.
PORT SCANNING
A high level abstraction of code used to outline the steps in an algorithm is called ___.
PSEUDOCODE
In a penetration test, this team consists of penetration testers who have been given some background knowledge of the infrastructure is called ___.
RED TEAM
A graphically intensive vulnerability scanner is called ___.
RETINA
In a penetration test, theis team is comprised of testers who are given no knowledge of the infrastructure, and are attacking a target that is unaware of their existence until the attack is made and is called ___.
TIGER TEAM
A method of testing that ensures that a specific function or module works as designed is called ___.
UNIT TESTING
- It is necessary to consider security issues during every phase of the software development life cycle.
TRUE OR FALSE
TRUE
- What occurs during the sunset phase of a security system’s life cycle?
- Electronic media is wiped clean
- Paper documentation is shredded or archived
- Old equipment is destroyed or disposed of in a secure manner.
- All the above
Electronic media is wiped clean
Paper documentation is shredded or archived
Old equipment is destroyed or disposed of in a secure manner.
- Which of the following are primary activities for an information security team? (Select two)
- Researching new exploits
- Monitoring/incident handling
- Testing
- Upgrading security systems
Monitoring/incident handling
Testing
- Port scanning is an example of ___ testing.
Nonintrusive
- Penetration testing is an example of ___ testing.
Intrusive
- Which of the following test is the most accurate way to test security incident response?
- Open
- Blind
- Double-blind
- Automated
Double-blind
- Gap analysis in which domain focuses primarily on the effectiveness of an organization’s training program?
- User
- Workstation
- LAN
- LAN to WAN
- WAN
- System/Application
- Remote access
User
- A Web application security scanner is a good tool to use when testing which domain?
- User
- Workstation
- LAN
- LAN to WAN
- WAN
- Remote access
WAN
- Penetration testing is a risky operation for both the organization and the testers.
TRUE OR FALSE
TRUE
- Which penetration testing team may be comprised of systems administrators in other departments of within an organization?
- Red
- Blue
- Tiger
- Orange
Red
- Which penetration testing team is comprised of systems administrators who defend the network and respond to the activities of the penetration testers?
- Red
- Blue
- Tiger
- Orange
Blue
- Which penetration testing team is given no prior knowledge of the IT infrastructure and uses the same tools and strategies that an actual attacker would use?
- Red
- Blue
- Tiger
- Orange
Tiger
- The clean-up phase of a penetration test is the responsibility of which individual or group?
- Systems administrator
- Upper management
- Penetration testing team
- Help desk
Penetration testing team
- A penetration test report should include which of the following? (Select three)
- Description of gaps and risk exposures found during the test
- List of passwords uncovered by the penetration testing team
- Remediation plans for closing security gaps
- Cost analysis and solution prioritization based on risk exposure
Description of gaps and risk exposures found during the test
Remediation plans for closing security gaps
Cost analysis and solution prioritization based on risk exposure
