Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
IT0202 - FA1
Modules 1-2
| Question | Answer |
|---|---|
| Which tool would be useful when performing a network infrastructure penetration test? Group of answer choices interception proxies tool bypassing firewalls and IPSs tool vulnerability scanning tool mobile application testing tool | bypassing firewalls and IPSs tool |
| What characterizes a partially known environment penetration test? | The test is a hybrid approach between unknown and known environment tests. |
| Which threat actor term describes a well-funded and motivated group that will use the latest attack techniques for financial gain? Group of answer choices state-sponsored attacker insider threat organized crime hacktivist | organized crime |
| Which tools should be used for testing the server and client platforms in an environment? Group of answer choices interception proxies tools de-authorizing network devices tools vulnerability scanning tools cracking wireless encryption tools | vulnerability scanning tools |
| Which penetration testing methodology is a comprehensive guide focused on web application testing? Group of answer choices MITRE ATT&CK OWASP WSTG OSSTMM NIST SP 800-115 | OWASP WSTG |
| Which type of penetration test would only provide the tester with limited information such as the domain names and IP addresses in the scope? | unknown-environment test |
| What two resources are evaluated by a network infrastructure penetration test? (Choose two.) Group of answer choices CSPs web servers back-end databases IPSs AAA servers | IPSs AAA servers |
| Which option is a Linux distribution URL that provides a convenient learning environment about pen testing tools and methodologies? Group of answer choices vmware.com attack.mitre.org parrotsec.org virtualbox.org | parrotsec.org |
| What is an insider threat attack? | An attack perpetrated by disgruntled employees inside an organization. |
| What is a state-sponsored attack? | An attack perpetrated by governments worldwide to disrupt or steal information from other nations. |
| A company hires a cybersecurity consultant to perform penetration testing to assess government regulation compliance. The consultant is preparing the final report after the penetration testing is completed. In which section of the report should the consul | disclaimers |
| A company hires a cybersecurity consultant to perform penetration tests and review the rules of engagement documents. What are three examples of typical elements in the rules of engagement document? (Choose three.) | preferred method of communication testing timeline location of testing |
| A company hires a cybersecurity professional to perform penetration testing to assess government regulation compliance. Which document will be provided to the cybersecurity professional that specifies a detailed and descriptive list of all the deliverable | statement of work (SOW) |
| An Internal Revenue Service office in New York is considering moving some services to a cloud computing platform. Which U.S. government regulation must the office follow in the process? Group of answer choices FFIEC FedRAMP HIPAA GDPR | FedRAMP |
| A company hires a cybersecurity consultant to perform penetration tests. The consultant is working with the company to set up communication procedures. Which two protocols should be considered for exchanging emails securely? (Choose two.) | PGP S/MIME |
| A company hires a cybersecurity consultant to assess applications using different APIs. Which document should the company provide to the consultant about an XML-based language used to document a web service’s functionality? | Web Services Description Language (WSDL) document |
| A company hires a cybersecurity consultant to perform penetration testing to assess government regulation compliance. Which document must the consultant receive that specifies the agreement between the consultant and the company for the penetration testin | contract |
| An employee of a cybersecurity consulting firm in the U.S. is assigned to help assess the system and operation vulnerabilities of several financial institutions in Europe. The task includes penetration tests for compliance. What is a key element the emplo | documentation of permission for performing the tests from the client institutions |
| An US university in California plans to offer online courses to students in partner universities in France and Germany. Which regulation should the university follow when those courses are offered? Group of answer choices HIPAA FedRAMP GDPR FERPA | GDPR |
| In the healthcare sector, which term defines an entity that processes nonstandard health information it receives from another entity into a standard format? Group of answer choices healthcare provider business associates health plan healthcare cleari | healthcare clearinghouse |
| Sometimes a tester cannot virtualize a system to do the proper penetration testing. What action should be taken if a system cannot be tested in a virtualized environment? | a full backup of the system |
| What kind of security weakness is evaluated by application-based penetration tests? Group of answer choices logic flaws wireless deployment firewall security data integrity between a client and a cloud provider | logic flaws |
| Which statement best describes the term ethical hacker? | a person who mimics an attacker to evaluate the security posture of a network |
| What characterizes a known environment penetration test? | The tester could be provided with network diagrams, IP addresses, configurations, and user credentials. |
| Which tool should be used to perform an application-based penetration test? Group of answer choices interception proxies tool bypassing firewalls and IPSs tool cracking wireless encryption tool sniffing traffic tool | interception proxies tool |
| Which option is a Linux distribution that includes penetration testing tools and resources? Group of answer choices SET BlackArch PTES OWASP | BlackArch |
| What are two examples of sensitive authentication data associated with a payment card that requires compliance with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose two.) | full magnetic strip data or equivalent data on a chip CAV2/CVC2/CVV2/CID |
| In the healthcare sector, which term is used to define an entity that provides payment for medical services? Group of answer choices health plan business associates healthcare provider healthcare clearinghouse | health plan |
| A company hires a cybersecurity consultant to assess vulnerability on crucial web application devices such as web and database servers. Which document should the company provide to help the consultant document and define what systems are in the testing? | system and network architectural diagram |
| A company hires a cybersecurity consultant to perform penetration tests. The consultant is discussing with the company about the penetration testing strategy. Which statement describes the term unknown-environment testing? | This type of testing is where the consultant will be provided with very limited information about the targeted systems and network. |
| A company hires a cybersecurity professional to perform penetration tests to assess government regulation compliance. Which legal document should be provided to the cybersecurity professional that specifies the expectations and constraints, including qual | service-level agreement (SLA) |
| In e-commerce, what determines the application of the Payment Card Industry Data Security Standard (PCI DSS) requirements? Group of answer choices approved scanning vendor merchant primary account number payment brand | primary account number |
| Which type of threat actor uses cybercrime to steal sensitive data and reveal it publicly to embarrass a target? Group of answer choices organized crime hacktivist insider threat state-sponsored attacker | hacktivist |
| When conducting an application-based penetration test on a web application, the assessment should also include testing access to which resources? Group of answer choices AAA servers cloud services switches, routers, and firewalls back-end databases | back-end databases |
| What is the purpose of bug bounty programs used by companies? | reward security professionals for finding vulnerabilities in the systems of the company |
| Collection of different matrices of tactics and techniques that adversaries use while preparing for an attack | MITRE ATT&CK |
| Covers the high-level phases of web application security testing | OWASP WSTG |
| Provides organizations with guidelines on planning and conducting information security testing | NIST SP 800-115 |
| Lays out repeatable and consistent security testing | OSSTMM |
| Provides information about types of attacks and methods | PTES |
| Which three options are phases in the Penetration Testing Execution Standard (PTES)? (Choose three.) Group of answer choices Threat modeling Penetration Reporting Enumerating further Network mapping Exploitation | Threat modeling Reporting Exploitation |
| Which two options are phases in the Information Systems Security Assessment Framework (ISSAF)? (Choose two.) Group of answe choices Pre-engagement interactions Maintaining access Reporting Post-exploitation Vulnerability identification | Maintaining access Vulnerability identification |
| Which two options are phases in the Open Source Security Testing Methodology Manual (OSSTMM)? (Choose two.) Group of answer choices Vulnerability Analysis Maintaining Access Work Flow Network Mapping Trust Analysis | Work Flow Trust Analysis |
| Which penetration testing methodology is a comprehensive guide focused on web application testing? Group of answer choices MITRE ATT&CK OWASP WSTG NIST SP 800-115 OSSTMM | OWASP WSTG |
| What does the “Health Monitoring” requirement mean when setting up a penetration test lab environment? | The tester needs to be able to determine the causes when something crashes. |
| Which tools should be used to perform a wireless infrastructure penetration test? Group of answer choices web vulnerability detection tools traffic manipulation tools proxy interception tools de-authorizing network devices tools | de-authorizing network devices tools |
| A contractor is hired to review and perform cybersecurity vulnerability assessments for a local health clinic facility. Which U.S. government regulation must the contractor understand before the contractor can start? | HIPAA |
| Which U.S. government agency is responsible for enforcing the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act (GLB Act)? | Federal Trade Commission (FTC) |
| Provides general guidance and best practices for the management of cryptographic keying material | Part 1: General |
| Provides guidance on policy and security planning requirements for U.S. government agencies | Part 2: Best Practices for Key Management Organization |
| Provides guidance whA company hires a cybersecurity consultant to perform penetration testing to assess government regulation compliance. The company wants the consultant to disclose information to them and no one else. Which type of NDA agreement should | Part 3: Application Specific Key Management Guidance |
| An employee of a cybersecurity consulting firm in the U.S. is assigned to help assess the system and operation vulnerabilities of several financial institutions in Europe. The task includes penetration tests for compliance. What is a key element the empl | documentation of permission for performing the tests from the client institutions |
| A company hires a cybersecurity consultant to perform penetration testing to assess government regulation compliance. The company wants the consultant to disclose information to them and no one else. Which type of NDA agreement should be presented to the | unilateral NDA |
| A company hires a cybersecurity consultant to perform penetration tests and review the rules of engagement documents. The consultant notices that one element specifies that the tests should be performed toward only web applications on websites www1.compan | types of allowed or disallowed tests |
| A company hires a cybersecurity consultant to assess applications using different APIs. Which document should the company provide to the consultant about a query language for APIs and a language for executing queries at runtime? | GraphQL documentation |
| A company hires a cybersecurity consultant to perform penetration tests. What can cause scope creep of the engagement? | ineffective identification of what technical and nontechnical elements will be required for the penetration test |
| A company hires a cybersecurity consultant to perform penetration tests. What should be the consultant’s first step in validating the engagement scope? | Question the company contact person and review contracts. |
| A company hires a cybersecurity consultant to perform penetration tests. What is the key difference between unknown-environment testing and known-environment testing? | the amount of information provided to the consultant |
Created by:
pangalankoiezrawr