Security Assessment and Testing Flashcards
What is the most important step of planning a security audit?
Setting a clear set of goals.
SOC 1 pertains to financial controls. What does SOC stand for?
Service Organization Controls
SOC 2 is a very detailed report that pertains to trust services. (Security, Availability, Confidentiality, Process Integrity, and Privacy). Is it intended for publication to the general public?
No. SOC 3 is.
You want a non-intrusive test of your security by a third party that doesn’t know your network at all. What kind do you want?
A. White Box Penetration Test
B. Black Box Penetration Test
C. White Box Vulnerability Test
D. Black Box Vulnerability Test
D
You want a thorough test of your security by a third party that knows your network a little, but not completely. Your internal security team will not be aware of the testing. What kind do you want?
A. Black Box Penetration Test, Blind Test
B. Grey Box Penetration Test, Double Blind Test
C. Grey Box Vulnerability Test, Double Blind Test
D. White Box Vulnerability Test, Blind Test
B
double-blind aka stealth assessment
You want a thorough test of your security by a third party that knows only publicly available data. Your internal security team will be aware of the testing What kind do you want?
A. Double Blind Test
B. Blind Test
C. Grey Box
D. White Box
B
These are scripted events that mimic the behaviors of real users and allow security professionals to systematically test the performance of critical services.
Synthetic transactions
think INTERMAPPER
The systematic testing of a given set of exchange points for data between systems and/or users.
A. Code Review
B. Log Review
C. Interface Testing
D. Management Review
C
___________ measure the risk inherent in performing a given action or set of actions.
KRI
Key Risk Indicators
A formal meeting to determine whether the information security management systems are effectively accomplishing their goal.
A. Code Review
B. Log Review
C. Interface Testing
D. Management Review
D
Which of the following is not a good step to take to prevent log tampering?
A. Replication B. Cryptographic hash chaining C. Remote Logging D. Write Once Media E. Duplex communication
E
The process of teaching a security set of skills that will allow people to perform specific functions better.
Security Training
The process of exposing people people to security issues so that they may be able to recognize them and better respond to them.
Security Awareness Training
Social Engineering through a digital form
phishing
A used case that includes threat actors and the tasks they want to perform on the system
misuse case
