1A: Define Organizational Pentesting

Question 1

What are the three controls utilized to ensure CIA of system resources?

Answer 1

1. Administrative Controls
2. Physical Controls
3. Technical or Logical Controls

Question 2

Which of the three controls utilized to ensure CIA is a security measure implemented to monitor adherence to organizational policies and procedures?

Answer 2

Administrative Control

Question 3

Which of the three controls utilized to ensure CIA is used to restrict, detect, and monitor access to specific physical areas or assets?

Answer 3

Physical Control

Question 4

Which of the three controls (administrative, physical, technical/logical) utilized to ensure CIA, automate protection to prevent unauthorized access or misuse, and include Access Control Lists (ACLs), and Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS)?

Answer 4

Technical or Logical Control

Question 5

Which principle states that an object should only be allocated the minimum necessary rights, privileges, or information in order to perform its role?

Answer 5

Principle of Least Privilege

Question 6

What is the term that represents the consequence of a threat exploiting a vulnerability which can result in financial loss, business disruption, or physical harm?

Answer 6

Risk

Question 7

What is the formula for defining risk?

Answer 7

Risk = Threat x Vulnerability

Question 8

What term represents something such as malware or a natural disaster, that can accidentally or intentionally exploit a vulnerability and cause undesirable results?

Answer 8

Threat

Question 9

What term is a weakness or flaw, such as a software bug, system flaw, or human error that can be exploited by a threat?

Answer 9

Vulnerability

Question 10

What type of analysis is a security process used to assess risk damages that can affect an organization?

Answer 10

Risk Analysis

Question 11

What type of appliance is an all-in-one security appliance and agent that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data loss prevention, content filtering, and so on.

Answer 11

Unified Threat Management (UTM) Appliance

Question 12

What term defines the cyclical process of identifying, assessing, analyzing, and responding to risks.

Answer 12

Risk Management

Question 13

What are the four steps of the CompTIA structured PenTesting process?

Answer 13

1. Planning and Scoping
2. Information Gathering and Vulnerability Scanning
3. Attacks and Exploits
4. Reporting and Communication

Question 14

What are the eight steps of the expanded CompTIA structured PenTesting process? (acronym: srsgmcar)

Answer 14

1. Planning and Scoping
2. Reconnaissance
3. Scanning
4. Gaining Access
5. Maintaining Access
6. Covering Tracks
7. Analysis
8. Reporting