This chapter is from the book
This chapter is from the book
This chapter is from the book
Answer Review Questions
For which of the following penetration tests does the testing team know an attack is coming but have limited knowledge of the network systems and devices and only publicly available information?
Target test
Physical test
Blind test
Double-blind test
Which of the following is NOT a guideline according to NIST SP 800-92?
Organizations should establish policies and procedures for log management.
Organizations should create and maintain a log management infrastructure.
Organizations should prioritize log management appropriately throughout the organization.
Choose auditors with security experience.
According to NIST SP 800-92, which of the following are facets of log management infrastructure? (Choose all that apply.)
General functions (log parsing, event filtering, and event aggregation)
Storage (log rotation, log archival, log reduction, log conversion, log normalization, log file integrity checking)
Log analysis (event correlation, log viewing, log reporting)
Log disposal (log clearing)
What are the two ways of collecting logs using security information and event management (SIEM) products, according to NIST SP 800-92?
Passive and active
Agentless and agent-based
Push and pull
Throughput and rate
Which monitoring method captures and analyzes every transaction of every application or website user?
RUM
Synthetic transaction monitoring
Code review and testing
Misuse case testing
Which type of testing is also known as negative testing?
RUM
Synthetic transaction monitoring
Code review and testing
Misuse case testing
What is the first step of the information security continuous monitoring (ISCM) plan, according to NIST SP 800-137?
Establish an ISCM program.
Define the ISCM strategy.
Implement an ISCM program.
Analyze the data collected.
What is the second step of the information security continuous monitoring (ISCM) plan, according to NIST SP 800-137?
Establish an ISCM program.
Define the ISCM strategy.
Implement an ISCM program.
Analyze the data collected.
Which of the following is NOT a guideline for internal, external, and third-party audits?
Choose auditors with security experience.
Involve business unit managers early in the process.
At minimum, perform bi-annual audits to establish a security baseline.
Ensure that the audit covers all systems and all policies and procedures.
Which SOC report should be shared with the general public?
SOC 1, Type 1
SOC 1, Type 2
SOC 2
SOC 3
Which of the following is the last step in performing a penetration test?
Document the results of the penetration test and report the findings to management, with suggestions for remedial action.
Gather information about attack methods against the target system or device.
Document information about the target system or device.
Execute attacks against the target system or device to gain user and privileged access.
In which of the following does the testing team have zero knowledge of the organization’s network?
Gray-box testing
Black-box testing
White-box testing
Physical testing
Which of the following is defined as a dynamic testing tool that provides input to the software to test the software’s limits and discover flaws?
Interface testing
Static testing
Test coverage analysis
Fuzz testing
Which factors should security professionals follow when performing security testing? (Choose all that apply.)
Changes that could affect the performance
System risk
Information sensitivity level
Likelihood of technical failure or misconfiguration
Which of the following can a hacker use to identify common vulnerabilities in an operating system running on a host or server?
Operating system fingerprinting
Network discovery scan
Key performance and risk indicators
Third-party audits