RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 24 of 27

Month 7: The first audit

In this chapter Objectives 5.5

  1. Audits and assessments
  2. Penetration testing
  3. Chapter recap

Objective 5.5

Audits and assessments

Attestation

Attestation is a formal statement that something is true and accurate, backed by evidence. An auditor attests that controls work as described; managers attest that a report is accurate. It is what turns "we think we are compliant" into a signed opinion others can rely on.

Internal audits and assessments

Done by or for the organization itself. Compliance audits check that internal rules and outside requirements are being followed. The audit committee (usually a board committee) oversees internal and external audits and makes sure findings are fixed. Self-assessments are reviews teams do of their own controls, often with a checklist, to find gaps before the auditors do.

External audits and assessments

Done by outsiders. Regulatory audits are run by or for a regulator to check legal requirements. Examinations are formal reviews by an outside body (such as a regulator examining records). An assessment evaluates controls against a standard or framework and reports gaps. An independent third-party audit is done by an outside firm with no stake in the result, giving the most trusted opinion.

Exam tip Exam tip: "most objective" or "independent assurance for customers" = independent third-party audit.

Objective 5.5

Penetration testing

Pen test types

What the test targets and who plays which side:

  • Physical: tests doors, locks, badges and people (can a tester walk into the server room?).
  • Offensive: attacking the organization like a real adversary (red team).
  • Defensive: detecting and responding to the attack (blue team).
  • Integrated: attackers and defenders working together and sharing results (often called purple team).

How much the testers know

Known environment (white box): testers get full details (network diagrams, source code). Thorough and efficient. Partially known environment (gray box): some details, like a normal user account. Unknown environment (black box): no details; testers start like an outside attacker.

Three boxes showing how much penetration testers are told. Known environment, formerly white box: full details such as network diagrams and source code; thorough and efficient. Partially known environment, gray box: some details, such as a normal user account. Unknown environment, black box: no details; the testers start like an outside attacker.
Known, partially known or unknown environment: how much the testers are told.

Exam tip Trap: unknown environment is the most realistic outside view, but known environment usually finds the most in the time available.

Reconnaissance

Before attacking, testers gather information. Passive reconnaissance never touches the target directly: public websites, DNS records, social media, job postings, search engines. Active reconnaissance interacts with the target and can be detected: port scans, ping sweeps, banner grabbing, vulnerability scans.

Exam tip Exam tip: "looked up public records and LinkedIn" = passive. "ran a port scan" = active.

Check yourself 1A pen tester reads Kibble & Co.'s job ads and DNS records to learn which systems it uses, without sending any traffic to its servers. What is this?

  1. Active reconnaissance
  2. Passive reconnaissance
  3. Defensive testing
  4. Known environment testing
Show the answer

Answer: B. Passive reconnaissance

Gathering public information without touching the target's systems is passive reconnaissance.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.