Testing Frameworks & Methodologies

Question 1

OSSTMM stands for

Answer 1

Open Source Security Testing Methodology Manual

Question 2

OSSTMM has what structured stages

Answer 2

1. Testing
2. Analysis
3. Measurement

Question 3

Rav stands for?

Answer 3

Risk Assessment Value

Question 4

What are the Primary Matrices of the MITRE ATT&CK Framework?

Answer 4

Enterprise Matrix
Mobile Matrix
Industrial COntrol System (ISC) Matrix

Question 5

Key Components of the MITRE ATT&CK Framework are:

Answer 5

1. Reconnaissance
2. Resource development
3. Initial access
4. Execution
5. Persistence
6. Privilege esclation
7. Defense evasion
8. Credential access
9. Discovery
10. Lateral movement
11. Collection
12. Command and control
13. Exfiltration
14. Impact

Question 6

What are the OWASP Top 10:

Answer 6

A01:2021 - Broken Access Control
A02:2021 - Cryptographic Failures
A03:2021 - Injection
A04:2021 - Insure Design
A05:2021 - Security Misconfiguration
A06:2021 - Vunerable and Outdates Components
A07:2021 - Identification and Authentication Failures
A08:2021 - Software and Data Integruity Failures
A09:2021 - Security Logging and Monitoring Failures
A10:2021 - Server-Side REquest Forgery (SSRF)

Question 7

MASVS stand for

Answer 7

OWASP Mobile Application Security Verification Standard

Question 8

The Purdue Model is part of what?

Answer 8

Purdue Enterprise Reference Architecture (PERA)

Question 9

The Purdure Model protects what?

Answer 9

Operational Technologies (OT)

Question 10

The Purdue Model divides the ICS architecture into how many zones?

Answer 10

6

Question 11

What are the Purdue Model zones?

Answer 11

Level 4/5 - Enterprise
DMZ
Level 3 - Operation & Control
Level 2 - Control
Level 1 - Process
Level 0 - Process

Question 12

CREST stands for

Answer 12

Council of Registered Ethical Security Testers

Question 13

PTES stands for

Answer 13

Penetration Testing Execution Standard.

Question 14

The steps in the PTES are:

Answer 14

1. Pre-engagement interactions
2. Threat modeling
3. Intelligence gathering
4. Vulnerability analysis
5. Exploitation
6. Post-exploitation
7. Reporting

Question 15

ISSAF stands for

Answer 15

Information System Security Assessment Framework

Question 16

ISSAF is no longer supported, it has the following phases:

Answer 16

1. Planning and Preparation
2. Assessment
3. Reporting, Clean up and destroy artifacts

Question 17

DREAD Threat model Framework was made by Microsoft and stand for:

Answer 17

Damage Potential
Reproducibility
Exploitability
Affected users
Discoverability

Question 18

STRIDE Threat Modeling Framework stands for

Answer 18

Spoofing
Tampering
Repudiation
Information disclosure
Denial of service
Elevation of privilege

Question 19

STRIDE is used to for

Answer 19

Threat modeling

Question 20

OCTAVE Threat Modeling Framework stand for:

Answer 20

Operationally critial threat asses and vulnerability evaluation

Question 21

OCTAVE-S is for

Answer 21

small organisations

Question 22

OCTAVE Allegro does what

Answer 22

simplifies the risk assessment process

Question 23

OCTAVE Forte is a

Answer 23

highly adapatable variation

Question 24

CVE Stands for

Answer 24

common vulnerabilities and exposures

Question 25

CWE stands for:

Answer 25

common weakness enumerations

Question 26

CAPEC stands for

Answer 26

Common attack Pattern Enumerations and classifications