Security+ topic 5.5
Audits, Assessments, and Penetration Testing
Audits and assessments check whether security works. They can be internal (self-assessments, internal audit) or external (regulators, independent third parties). A penetration test is an authorized simulated attack. Testers may know everything about the environment (known environment), something (partially known), or nothing (unknown environment). Rules of engagement set the scope, timing and limits. Red teams attack, blue teams defend, and purple teams work together. Testers gather information through passive and active reconnaissance, and frameworks such as MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model describe how attackers operate.
| Test type | Testers start with | Simulates |
|---|---|---|
| Known environment | Full details: diagrams, code, accounts | An insider or a thorough audit |
| Partially known | Some details, such as IP ranges | An attacker with some inside info |
| Unknown environment | Nothing but the company name | An outside attacker |
Audits, Assessments, and Penetration Testing vocabulary
- Penetration test: An authorized, simulated attack to find weaknesses before real attackers do.
- Rules of engagement: The agreed scope, timing, and limits of a penetration test.
- Unknown environment test: A penetration test where the testers start with no inside information.
- MITRE ATT&CK: A public knowledge base of attacker tactics and techniques.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. Testers are hired to attack a company with no inside information, just like an outside attacker. Which of the following test types is this?
- (A) Known environment
- (B) Partially known environment
- (C) Unknown environment
- (D) Tabletop
Show answer
(C) Unknown environment Starting with no information is an unknown environment test.
2. Before a penetration test begins, which of the following documents defines its scope, timing and limits?
- (A) Rules of engagement
- (B) Acceptable use policy
- (C) Certificate of destruction
- (D) Risk register
Show answer
(A) Rules of engagement Rules of engagement define what testers may do.
3. A tester reads a company's job postings and public DNS records without sending any traffic to its systems. Which of the following is this?
- (A) Passive reconnaissance
- (B) Active reconnaissance
- (C) Exploitation
- (D) Lateral movement
Show answer
(A) Passive reconnaissance Gathering public information without touching the target is passive reconnaissance.
4. Attackers and defenders work together during an exercise so the defenders learn from each attack. Which of the following is this?
- (A) A purple team exercise
- (B) A red team exercise
- (C) A blue team exercise
- (D) A bug bounty
Show answer
(A) A purple team exercise Purple teaming combines red and blue to improve defenses.