CREST - CPSA MAIN
What is another structure of a penetration test? - CORRECT ANSWER-
Reconnaissance
Vulnerability Scanning
Investigation
Exploitation
What is does infrastructure testing include? - CORRECT ANSWER-Includes all internal
computer systems, associated external devices, internet networking, cloud and
virtualization testing.
What are the types of infrastructure testing? - CORRECT ANSWER-- External
Infrastructure Penetration Testing
- Internal Infrastructure Penetration Testing
- Cloud and Virtualization Penetration Testing
- Wireless Security Penetration Testing
What does External Infrastructure Testing include? - CORRECT ANSWER-Mapping
flaws in the external infrastructure
What are the benefits of External Infrastructure Testing ? - CORRECT ANSWER--
Identifies flaws within the firewall configuration that could be misused.
- Finds how information could be leaked out from the system
- Suggests how these issues could be fixed
- Prepares a comprehensive report highlighting the security risk of the networks and
suggests solutions
- Ensures overall efficiency and productivity of your business
What are the benefits of Internal Infrastructure testing? - CORRECT ANSWER--
Identifies how an internal attacker could take advantage of even a minor security flaw
- Identifies the potential business risk and damage that an internal attacker can inflict
- Improves security systems of internal infrastructure
- Prepares a comprehensive report giving details of the security exposures of internal
networks along with the detailed action plan on how to deal with it
3306? - CORRECT ANSWER-MySQL (structured Query Language) Database
management system for web database, data warehousing, e-commerce, and logging
applications
What port does squid proxy use? - CORRECT ANSWER-3128
,What are the benefits of a penetration test? - CORRECT ANSWER-- Enhancement of
the management system
- Avoid fines
- Protection from financial damage
- Customer protection
What is the structure of a penetration test? - CORRECT ANSWER-Planning and
Preparation
Reconnaissance
Discovery
Analyzing information and risks
Active intrusion attempts
Final analysis
Report Preparation
What are the benefits of cloud and virtualization penetration testing? - CORRECT
ANSWER-- Discover the real risks within the virtual environment and suggests the
methods and costs to fix the threats and flaws
- Provides guidelines and an action plan how to resolve the issues
- Improves the overall protection systems
- Prepares a comprehensive security system report of the cloud computing and
virtualization, outline the security flaws, causes and possible solutions
What are the benefits of wireless security penetration testing ? - CORRECT ANSWER--
To find the potential risk caused by your wireless device
- To provide guidelines and an action plan on how to protect from the external threats
- For preparing a comprehensive security system report of the wireless networking, to
outline the security flaw, causes, and possible solutions
What is Black Box Testing? - CORRECT ANSWER-Black-box testing is a method in
which the tester is provided no information about the application being tested.
What are the advantages of Black Box Testing? - CORRECT ANSWER-- Test is
generally conducted with the perspective of a user, not the designer
- Verifies contradictions in the actual system and the specifications
What are the disadvantages of black box penetration testing? - CORRECT ANSWER--
Particularly, these kinds of test cases are difficult to design
- Possibly, it is not worth, in-case designer has already conducted a test case
- It does not conduct everything
What is white box penetration testing ? - CORRECT ANSWER-A tester is provided a
whole range of information about the systems and/or network such as schema, source
code, os details, ip address, etc.
,What are the advantages of white box penetration testing? - CORRECT ANSWER-- It
ensures that all independent paths of a module have been exercised
- It ensures that all logical decisions have been verified along with their true and false
value.
- It discovers the typographical errors and does syntax checking
- It finds the design errors that may have occurred because of the difference between
logical flow of the program and the actual execution.
What are the important highlights of the computer misuse act 1990? - CORRECT
ANSWER-Section 1: Unauthorized access to computer material
Section 2: Unauthorized access with intent to commit or facilitate commission of further
offenses
Section 3: Unauthorized acts with intent to impair, or with recklessness as to impairing
the operation of a computer
Unauthorized modification of computer material
What are the important highlights of the human rights act 1998? - CORRECT
ANSWER-- The right to life
- The right to respect for private and family life
- The right to freedom of religion and belief
- Your right not to be mistreated or wrongly punished by the state
when capturing the scope of a penetration test, what information requires consent to
meet the UK laws? - CORRECT ANSWER--Name & Position of the individual who is
providing consent
-Authorized testing period - both the date range and hours that testing is permitted
- Contact information for members of technical staff, who may provide assistance during
the test
- IP addresses or URL that are in scope of testing
- Exclusions to certain hosts, services or areas within application testing
Credentials that may be required as part of authenticated application testing
What are the important highlights of the data protection act 1998? - CORRECT
ANSWER-- Personal data must be processed fairly and lawfully
- be obtained only for lawful purposes and not processed in any manner incompatible
with those purposes
- be adequate, relevant and not excessive
- be accurate and current
- not be retained for longer than neccessary
- be processed in accordance with the rights and freedoms of data subjects
- Be protected against unauthorized or unlawful processing and against accidental loss,
destruction or damage
, What are the important highlights of the police and justice act 2006? - CORRECT
ANSWER-- Make amendments to the computer misuse act 1990
- increased penalties of computer misuse act (makes unauthorized computer access
serious enough to fall under extradition)
- Made it illegal to perform DOS attacks
- Made it illegal to supply and own hacking tools.
- Be careful about how you release information about exploits.
What issues may arise between a tester and his client? - CORRECT ANSWER-- The
tester is unknown to his client - so, on what grounds, he should be given access of
sensitive data
-Who will take the guarantee of security of lost data?
- The client may blame for the loss of data or confidentiality to tester.
How can you prevent legal issues when doing a penetration test? - CORRECT
ANSWER-A statement of intent should be duly signed by both parties
- The tester has the permission in writing, with clearly defined parameters
- the company has the details of its pen tester and an assurance that he would not leak
any confidential data
What does scoping a penetration test involve? - CORRECT ANSWER-- All relevant risk
owners
- Technical staff knowledgeable about the target system
- A representative of the penetration test team
- Risk owners should outline any areas of special concern
- Technical staff should outline technical boundaries of the organizations IT estate
- The penetration test team should identify what testing they believe will give a full
picture of the vulnerability status of the estate
What is a IP protocol? - CORRECT ANSWER-The IP (Internet Protocol) is the network
layer communications protocol in the Internet protocol suite used for relaying datagrams
across network boundaries
What is the TCP protocol? - CORRECT ANSWER-TCP (transmisson control protocol) a
main protocol from the Internet protocol suite.
What is the Task of TCP? - CORRECT ANSWER-To create a connection between the
client and server before data can be sent.
What will applications that do not require a reliable data stream use? - CORRECT
ANSWER-User datagram protocol
What is the task of the Internet Protocol? - CORRECT ANSWER-to deliver packets from
the source host to the destination host based on the IP addresses in the packet
headers.
What is another structure of a penetration test? - CORRECT ANSWER-
Reconnaissance
Vulnerability Scanning
Investigation
Exploitation
What is does infrastructure testing include? - CORRECT ANSWER-Includes all internal
computer systems, associated external devices, internet networking, cloud and
virtualization testing.
What are the types of infrastructure testing? - CORRECT ANSWER-- External
Infrastructure Penetration Testing
- Internal Infrastructure Penetration Testing
- Cloud and Virtualization Penetration Testing
- Wireless Security Penetration Testing
What does External Infrastructure Testing include? - CORRECT ANSWER-Mapping
flaws in the external infrastructure
What are the benefits of External Infrastructure Testing ? - CORRECT ANSWER--
Identifies flaws within the firewall configuration that could be misused.
- Finds how information could be leaked out from the system
- Suggests how these issues could be fixed
- Prepares a comprehensive report highlighting the security risk of the networks and
suggests solutions
- Ensures overall efficiency and productivity of your business
What are the benefits of Internal Infrastructure testing? - CORRECT ANSWER--
Identifies how an internal attacker could take advantage of even a minor security flaw
- Identifies the potential business risk and damage that an internal attacker can inflict
- Improves security systems of internal infrastructure
- Prepares a comprehensive report giving details of the security exposures of internal
networks along with the detailed action plan on how to deal with it
3306? - CORRECT ANSWER-MySQL (structured Query Language) Database
management system for web database, data warehousing, e-commerce, and logging
applications
What port does squid proxy use? - CORRECT ANSWER-3128
,What are the benefits of a penetration test? - CORRECT ANSWER-- Enhancement of
the management system
- Avoid fines
- Protection from financial damage
- Customer protection
What is the structure of a penetration test? - CORRECT ANSWER-Planning and
Preparation
Reconnaissance
Discovery
Analyzing information and risks
Active intrusion attempts
Final analysis
Report Preparation
What are the benefits of cloud and virtualization penetration testing? - CORRECT
ANSWER-- Discover the real risks within the virtual environment and suggests the
methods and costs to fix the threats and flaws
- Provides guidelines and an action plan how to resolve the issues
- Improves the overall protection systems
- Prepares a comprehensive security system report of the cloud computing and
virtualization, outline the security flaws, causes and possible solutions
What are the benefits of wireless security penetration testing ? - CORRECT ANSWER--
To find the potential risk caused by your wireless device
- To provide guidelines and an action plan on how to protect from the external threats
- For preparing a comprehensive security system report of the wireless networking, to
outline the security flaw, causes, and possible solutions
What is Black Box Testing? - CORRECT ANSWER-Black-box testing is a method in
which the tester is provided no information about the application being tested.
What are the advantages of Black Box Testing? - CORRECT ANSWER-- Test is
generally conducted with the perspective of a user, not the designer
- Verifies contradictions in the actual system and the specifications
What are the disadvantages of black box penetration testing? - CORRECT ANSWER--
Particularly, these kinds of test cases are difficult to design
- Possibly, it is not worth, in-case designer has already conducted a test case
- It does not conduct everything
What is white box penetration testing ? - CORRECT ANSWER-A tester is provided a
whole range of information about the systems and/or network such as schema, source
code, os details, ip address, etc.
,What are the advantages of white box penetration testing? - CORRECT ANSWER-- It
ensures that all independent paths of a module have been exercised
- It ensures that all logical decisions have been verified along with their true and false
value.
- It discovers the typographical errors and does syntax checking
- It finds the design errors that may have occurred because of the difference between
logical flow of the program and the actual execution.
What are the important highlights of the computer misuse act 1990? - CORRECT
ANSWER-Section 1: Unauthorized access to computer material
Section 2: Unauthorized access with intent to commit or facilitate commission of further
offenses
Section 3: Unauthorized acts with intent to impair, or with recklessness as to impairing
the operation of a computer
Unauthorized modification of computer material
What are the important highlights of the human rights act 1998? - CORRECT
ANSWER-- The right to life
- The right to respect for private and family life
- The right to freedom of religion and belief
- Your right not to be mistreated or wrongly punished by the state
when capturing the scope of a penetration test, what information requires consent to
meet the UK laws? - CORRECT ANSWER--Name & Position of the individual who is
providing consent
-Authorized testing period - both the date range and hours that testing is permitted
- Contact information for members of technical staff, who may provide assistance during
the test
- IP addresses or URL that are in scope of testing
- Exclusions to certain hosts, services or areas within application testing
Credentials that may be required as part of authenticated application testing
What are the important highlights of the data protection act 1998? - CORRECT
ANSWER-- Personal data must be processed fairly and lawfully
- be obtained only for lawful purposes and not processed in any manner incompatible
with those purposes
- be adequate, relevant and not excessive
- be accurate and current
- not be retained for longer than neccessary
- be processed in accordance with the rights and freedoms of data subjects
- Be protected against unauthorized or unlawful processing and against accidental loss,
destruction or damage
, What are the important highlights of the police and justice act 2006? - CORRECT
ANSWER-- Make amendments to the computer misuse act 1990
- increased penalties of computer misuse act (makes unauthorized computer access
serious enough to fall under extradition)
- Made it illegal to perform DOS attacks
- Made it illegal to supply and own hacking tools.
- Be careful about how you release information about exploits.
What issues may arise between a tester and his client? - CORRECT ANSWER-- The
tester is unknown to his client - so, on what grounds, he should be given access of
sensitive data
-Who will take the guarantee of security of lost data?
- The client may blame for the loss of data or confidentiality to tester.
How can you prevent legal issues when doing a penetration test? - CORRECT
ANSWER-A statement of intent should be duly signed by both parties
- The tester has the permission in writing, with clearly defined parameters
- the company has the details of its pen tester and an assurance that he would not leak
any confidential data
What does scoping a penetration test involve? - CORRECT ANSWER-- All relevant risk
owners
- Technical staff knowledgeable about the target system
- A representative of the penetration test team
- Risk owners should outline any areas of special concern
- Technical staff should outline technical boundaries of the organizations IT estate
- The penetration test team should identify what testing they believe will give a full
picture of the vulnerability status of the estate
What is a IP protocol? - CORRECT ANSWER-The IP (Internet Protocol) is the network
layer communications protocol in the Internet protocol suite used for relaying datagrams
across network boundaries
What is the TCP protocol? - CORRECT ANSWER-TCP (transmisson control protocol) a
main protocol from the Internet protocol suite.
What is the Task of TCP? - CORRECT ANSWER-To create a connection between the
client and server before data can be sent.
What will applications that do not require a reliable data stream use? - CORRECT
ANSWER-User datagram protocol
What is the task of the Internet Protocol? - CORRECT ANSWER-to deliver packets from
the source host to the destination host based on the IP addresses in the packet
headers.
