Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA PenTest+ > Domain 1: Planning and Scoping > Flashcards

Domain 1: Planning and Scoping Flashcards

1
Q

What are the 6 overall steps in the PenTest process?

A
  1. Planning and Scoping
  2. Information Gathering
  3. Vulnerability Analysis
  4. Explotation
  5. Post Exploitation
  6. Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What happens during the planning and scoping phase during a Penetration Test?

A
  • Discuss with the client their requirements for the test
  • Define the scope
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Risk?

A

The proability that a threat will be realised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Vulnerability?

A

Any weakness in a systems design or implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Threat?

In relation to IT Security

A

Anything that could cause harm, loss, damage or compromise to IT systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where does Risk exsist?

A

When there is an overlap between vulnerability and threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Inherent Risk?

A

Occurs when risk is identified but no mitigation factors are applied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Residule Risk?

A

Occurs when risk is calculated after applying mitigations and security controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Risk Exception?

A

Risk created due to a security exemption being granted or failure to comply with corporate policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Risk Avoidance?

A

▪ Stops a risky activity or chooses a less risky alternative
▪ Eliminates the hazards, activities, and exposures with potential negative
effects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Risk Transfer?

A

Passes the risk to a third party, such as an insurance company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Risk Acceptance?

A

Accepts the current level of risk and the costs associated with it if that
risk were realized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Risk Appetite?

A

▪ The amount of risk an organization is willing to accept in pursuit of its
objectives
▪ Also called risk attitude and risk tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Risk Tolerance?

A

Specific maximum risk the organization is willing to take
about a specific identified risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the seven different types of controls?

A
  1. Compensative
  2. Corrective
  3. Detective
  4. Deterrent
  5. Directive
  6. Preventitive
  7. Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Corrective controls?

A

● Reduces the effect of an undesirable event or attack
● Examples: fire extinguishers and antivirus solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Compensative controls?

A

● Used in place of a primary access control measure to mitigate a
given risk
● Example: dual control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Detective controls?

A

● Detects an ongoing attack and notifies the proper personnel
● Examples: alarm systems, closed circuit television systems, and
honeypots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are Deterrent controls?

A

● Discourages any violation of security policies, both by attackers
and insiders
● Example: surveillance camera sign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are Directive controls?

A

● Forces compliance with the security policy and practices within
the organization
● Example: Acceptable Use Policy (AUP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are Preventitive controls?

A

● Prevents or stops an attack from occurring
● Examples: password protection, security badges, antivirus
software, and intrusion prevention systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are Recovery controls?

A

● Recovers a device after an attack
● Examples: Disaster Recovery Plans (DRPs), backups, and continuity
of operations plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the three broad catagories which covers controls?

A
  • Administrative (Managerial)
  • Logical (Technical)
  • Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are Administrative controls?

A

● Manages personnel and assets through security policies,
standards, procedures, guidelines, and baselines
● Examples: proper data classification and labeling, supervision of
personnel, and security awareness training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

-

What are Logical controls?

A

● Implemented through hardware or software and used to prevent
or restrict access to a system
● Examples: firewalls, intrusion detection systems, intrusion
prevention systems, authentication schemes, encryption, new
protocols, auditing or monitoring software, and biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Whats the difference between an Audit and Monitoring?

A

An Audit is a point in time evaluation whilst Monitoring is a ongoing process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does continuous monitoring include?

A

● Change management
● Configuration management
● Log monitoring
● Status report analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are physical controls?

A

● Protects the organization’s personnel and facilities
● Examples: fences, locks, security badges, proximity cards for entry
into the building, guards, access control vestibules, biometrics,
and other means of securing the facility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a PenTest Methodology?

A

▪ The systematic approach a pentester uses before, during, and after a
penetration test, assessment, or engagement
▪ Penetration tests use the same steps taken by threat actors or hackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the 4 stages of the CompTIA PenTest+ methodology?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the name of NIST’s PenTest methodology?

A

NIST SP 800-115

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the steps of the EC Council CEH PenTest methodology?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Adversary Emulation?

A

Mimicing the tackticks, techniques and proceedures (TTP’s) of a real worl threat actor in a penetration test.

32
Q

Why is it good to have a proper scoping process?

A

It ensures a cost effective penetration test.

33
Q

How do you narrow the scope of a penetration test?

A

Confirm the goals and objectives.

34
Q

What are the three things that can blur the lines for a penetration tester?

A
  • Wireless Local Area Network
  • VPN Connections
  • Cloud Migrations
35
Q

What is it important to identify in terms of assets for a penetration test?

A

web and mobile applications

36
Q

What are the six types of Threat Actors?

A
  1. Script Kiddies
  2. Insider Threat
  3. Competitor
  4. Organised Crime
  5. Hacktivist
  6. Nation State / Advanced Persistant Threat (APT)
37
Q

What is a Script Kiddie?

Threat Actor

A

The least skilled Threat Actor, who uses freely available tools on the internet or in openly available security toolsets that security penetration testers might also use.

38
Q

What is an Insider Threat?

Threat Actor

A

A Threat Actor with authorized access to an organisations network, policies, proceedures and business practices.

39
Q

What types of things protect against Insider Threat?

A
  • Data Loss Prevention (DLP)
  • Internal Defenses
  • SIEM
40
Q

What is a Competitor?

Threat Actor

A

A rogue business that attempts to conduct cyber espionage against an organization.

41
Q

What is an Organised Crime Threat Actor?

Threat Actor

A

A catagory of threat actor that is focused on hacking and computer fraud in order to receive finanical gain.

Usually well funded and can use sophisticated tools.

42
Q

What is a Hacktivist?

Threat Actor

A

Politically motivated hacker who targets governments, corporations and individuals to advance their own political ideologies and agendas.

43
Q

What is a Nation State / Advanced Persistant Threat (APT)?

Threat Actor

A

A group of attackers with exceptional capability, funding and organization with an intent to hack a network or system.

44
Q

What doe Nation State / ATP threat actors do?

A

Conduct highley covert attacks over long periods of time

45
Q

What are False Flag operations?

A

When the TTP’s of other Threat Actors are used to shif t the blame to them.

46
Q

As a Penetration Tester, what do you need to develop to imitate Nation State / ATP Threat Actors?

A

Developing your own custom code and exploits.

47
Q

What do Tier 1 Catagory Threat Actors do?

A

Have little money and rely on off-the-shelf tools and know exploits.

48
Q

What catogorises a Threat Actor as Tier 2?

A

they have a little money but have invested in their own tools against known vulnerabilities.

49
Q

What catogorises a Threat Actor as Tier 3?

A

They invest a lot of money to find unknown vulerabilities in order to make a profit.

50
Q

What catogorises a Threat Actor as Tier 4?

A

They are organised, highly technical, proficient and well funded hackers, working in teams to develop new exploits.

51
Q

What catogorises a Threat Actor as Tier 5?

A

Invests lots of money to create vulerabilities and exploits.

52
Q

What catogorises a Threat Actor as Tier 6?

A

They invest even more money to carry out cyber attacks and military and inteligence operations to achieve political, military and economic goals.

53
Q

What should the target list include?

A
  • Internal and External targets
  • First or Third Party targets
54
Q

What is an Internal Target?

A

The target is inside the organizations firewall and requires testers to be on site or gain access through a VPN, or exploit a users computer inside the organisations network.

55
Q

What is an External Target?

A

The target can be accessed directly across the internet. The target organisation must be informed if allowed to attack first-party hosted servers only or assets hosted by a third-party.

56
Q

What is a Physical Security assessment?

A

A target site at a location is tested by the penetration tester for physical access or some other goals.

57
Q

What is an On-Site Asset?

A

Any asset that is physically located where an attack is being carried out.

58
Q

Whats is an Off-Site Asset?

A

Any asset that provides a service for a company not necessiary located at the same place.

59
Q

What is the easiest attack vector for a Penetration Test?

A

Users

60
Q

What do you have to confirm when the Wireless Networks are in scope?

A
  • Which SSID’s are in and out of scope
  • Which assets are in scope by IP Address or ranges, Associated Domans and Sub Domans and DNS Servers.
61
Q

What is an Autonomous System Number (ASN)?

A

A unique identifier that defines a group of one or more IP Prefixes run by one or more network operators that maintain a single clearly-defined routing policy.

62
Q

What is scope creep?

A

Occurs when a client starts asking for more services than what is listed in the statement of works.

63
Q

What do you need to do if additional work is requested?

A
  • Make an addendum to the contract and add it to the scope of works and master contract
  • Pre-arrange cost for expansions
64
Q

What must you do before commencing a penetration test after a scope is agreed?

A

Consult with lawyer / solicitor before accepting a contract and ensure you can legally perform the service.

65
Q

Why must you be careful what penetration tools are used durign the engagement?

A

Some tools can be considered as survalienance tools in some countries.

See Wassenaar Agreement

66
Q

Whate are Rules of Engagement?

A

The ground rules that both the organization and the penetration tester must obide by.

67
Q

What are the five main features of a the Rules of Engagement?

A
  1. Timeline
  2. Locations
  3. Time Restrictions
  4. Transparency
  5. Boundaries
68
Q

What does the Timeline specify in the Rules of Engagement?

A
  • When the test will occur
  • Total time of engagement
  • Penetration Team will estimate which tasks will need performing and how long it’ll take.
  • Should include who is responsible for performing a task
69
Q

What should be specified under the locations in the Rules of Engagement?

A

All authorised locations, especially those across international borders.

70
Q

Where in the Rules of Engagement is the trusted agent specified?

A

Under the transparency section.

71
Q

Who provides the penetration tester with the resources from the target side?

A

The Trusted Agent.

72
Q

What does the Boundaries specifiy in the Rules of Engagement?

A

What systems may be targeted and what techniques can be utilized.

73
Q

What is a Compliance-Based Assessment?

A

A type of assessment that focuses on finding out if policies and regulations are being properly followed. The tester can use a checklist against the specific compliance to make sure the target is compliant.

74
Q

What is a Pre-Merger Assessment?

A

A type of assessment that is conducted before two companies merge with each other in a period of time known as due dilligence.

75
Q

What is an Unknown Environment assessment?

A

An assessment where the penetration tester has no prior knowledge of the target organisation or their network.

The tester will spend a lot of time in information gathering and vulnerability scanning phases.

76
Q

What is a partially known environment assessment?

A

The most common type of assessment which entails partial knowledge of the target organization and its information systems.

77
Q

What should be done when validating the scope?

A
  • Confirm all requirements
  • Confirm backup and recovery status
  • Who to contact when something goes wrong.
  • Review all areas of the Scope of Works and Rules of Engagement.
78
Q

What could happen if there is an unauthorized disclosure of information?

A

Your company may be liable.

79
Q

WHat can you do to protect yourself and your company before the penetration test has started?

A

Include liability wavers in the documentation.

CompTIA PenTest+ (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions