COMPTIA PENTES 1 UPDATED ACTUAL EXAM QUESTIONS CORRECT ANSWERS GRADED A
PLUS
Question:
Define Master service agreement (MSA).
Answer:
An MSA is a type of overarching contract reached between two or more parties where each party
agrees to most terms that will govern all other future transactions and agreements. The agreement
will cover conditions such as Payment terms Negotiated schedule of payment Product warranties
Assurance that a product meets certain conditions Intellectual property ownership Copyrights,
patents, and trademarks Dispute resolution Defines a process for resolving differences Allocation of
risk Provision that defines levels of responsibility between each party Indemnification Parties agree
to be financially responsible in certain circumstances This type of service agreement may also cover
other items, such as corporate social responsibility, business ethics, network and facility access, or
any other term critical for all future agreements.
Question:
Define Statement of work (SOW).
Answer:
The SOW is a formal document that is routinely employed in the field of project management,
which outlines project-specific work to be executed by a service vendor for an organization. An
SOW can also be a provision found in the Master Service Agreement. It explains the problem to be
solved, the work activities, the project deliverables, and the timeline for when the work is to be
completed. The statement of work typically addresses the following subjects: Purpose Reason for
the project Scope of work Describes the work activities to be completed Location of work Where
the work will be performed Period of performance The timeline for the project Deliverables
schedule Defines the project artifacts and due dates Applicable industry standards Relevant criteria
that must be followed Acceptance criteria Conditions that must be satisfied Special requirements
Travel, workforce requirements (certifications, education) Payment schedule Negotiated schedule of
payment (possibly derived from MSA)
Question:
,Define Rules of Engagement (ROE).
Answer:
Detailed guidelines and constraints regarding the execution of information security testing. The
ROE is established before the start of a security test, and gives the test team authority to conduct
defined activities without the need for additional permissions. he RoE can be part of the SOW or
treated as a separate deliverable. This document requires signatures from the service vendor as well
as organizational management who have the appropriate authority to exercise testing for the
organization. Cloud service provider approvals may also need to be added as an appendix to the
RoE, if applicable.
Question:
Define Risk.
Answer:
Risk = Probability * Damage Potential The scale is from 1 to 10, where 1 represents a risk that is
less likely to happen (probability) or minimal damage will occur (damage potential) and 10
represents a risk that is likely to happen or maximal damage will occur. The risk can then be
prioritized in three bands as either High (80- 100; urgent), Medium (40-79; less urgent), or Low
(1-39; nonurgent).
Question:
What is the OSINT Framework?
Answer:
The OSINT Framework is a static web page focused on information gathering and provides web
links and resources that can be used during the reconnaissance process. The website is broken out
into various nodes that offer unique paths for collecting information regarding a specific subject,
such as usernames, email addresses, social networks, IP addresses, etc. The OSINT Framework
helps point users in the right direction to find useful intelligence from various public and paid
resources. An interactive data mining software tool that can help users visualize and analyze
relationships using publicly accessible data from the Internet is called Maltego. It is a framework
that can rapidly expand the open-source knowledge of a target during a pentest.
Question:
What is Maltego CE?
, Answer:
Community edition of Maltego that ships with Kali Linux and is an interactive data mining software
tool that can help users visualize and analyze relationships using publicly accessible data from the
Internet is called Maltego. It is a framework that can rapidly expand the open-source knowledge of a
target during a pentest.
Question:
What is Shodan?
Answer:
The Shodan search engine scans the entire Internet, parsing banners for services and categorizing
the data returned by each device. The main page provides a search box that can be used to examine
content to find keywords or phrases. Advanced queries enable users to apply filters and boolean
logic operators to drill down into the results. It works similar to a typical web search engine such as
Google, Yahoo, or Bing. Filter example: telnet port:23 country:"US" You can search by service, OS,
product, etc. and it will display the following Top Countries Top Services Top Organizations Top
Operating Systems Top Products The Reports button on the top menu bar provides a quick and
painless way to generate a report based on the search criteria.
Question:
What is Censys?
Answer:
Censys works very much the same way as Shodan, as it allows users to query using keywords and
filters to discover and investigate devices, and to include public-facing IP addresses and domain
names with open ports and services on the Internet. The interface provides an intuitive search
feature that allows the user to query for just about anything, but more specifically ports, protocols,
services, operating systems, locations, etc. Censys data is grouped into three views (categories):
IPv4 Hosts, Top Million Websites, and Certificates. Censys provides additional information and
resources regarding query syntax, example queries (like popular websites without browser trusted
certificates), and data definitions through the help portion of their website. Filter options include:
AS, protocol, and tag Filter example: (telnet) AND protocols.raw: "23/telnet"
Question:
What is a 'WHOIS' search?
PLUS
Question:
Define Master service agreement (MSA).
Answer:
An MSA is a type of overarching contract reached between two or more parties where each party
agrees to most terms that will govern all other future transactions and agreements. The agreement
will cover conditions such as Payment terms Negotiated schedule of payment Product warranties
Assurance that a product meets certain conditions Intellectual property ownership Copyrights,
patents, and trademarks Dispute resolution Defines a process for resolving differences Allocation of
risk Provision that defines levels of responsibility between each party Indemnification Parties agree
to be financially responsible in certain circumstances This type of service agreement may also cover
other items, such as corporate social responsibility, business ethics, network and facility access, or
any other term critical for all future agreements.
Question:
Define Statement of work (SOW).
Answer:
The SOW is a formal document that is routinely employed in the field of project management,
which outlines project-specific work to be executed by a service vendor for an organization. An
SOW can also be a provision found in the Master Service Agreement. It explains the problem to be
solved, the work activities, the project deliverables, and the timeline for when the work is to be
completed. The statement of work typically addresses the following subjects: Purpose Reason for
the project Scope of work Describes the work activities to be completed Location of work Where
the work will be performed Period of performance The timeline for the project Deliverables
schedule Defines the project artifacts and due dates Applicable industry standards Relevant criteria
that must be followed Acceptance criteria Conditions that must be satisfied Special requirements
Travel, workforce requirements (certifications, education) Payment schedule Negotiated schedule of
payment (possibly derived from MSA)
Question:
,Define Rules of Engagement (ROE).
Answer:
Detailed guidelines and constraints regarding the execution of information security testing. The
ROE is established before the start of a security test, and gives the test team authority to conduct
defined activities without the need for additional permissions. he RoE can be part of the SOW or
treated as a separate deliverable. This document requires signatures from the service vendor as well
as organizational management who have the appropriate authority to exercise testing for the
organization. Cloud service provider approvals may also need to be added as an appendix to the
RoE, if applicable.
Question:
Define Risk.
Answer:
Risk = Probability * Damage Potential The scale is from 1 to 10, where 1 represents a risk that is
less likely to happen (probability) or minimal damage will occur (damage potential) and 10
represents a risk that is likely to happen or maximal damage will occur. The risk can then be
prioritized in three bands as either High (80- 100; urgent), Medium (40-79; less urgent), or Low
(1-39; nonurgent).
Question:
What is the OSINT Framework?
Answer:
The OSINT Framework is a static web page focused on information gathering and provides web
links and resources that can be used during the reconnaissance process. The website is broken out
into various nodes that offer unique paths for collecting information regarding a specific subject,
such as usernames, email addresses, social networks, IP addresses, etc. The OSINT Framework
helps point users in the right direction to find useful intelligence from various public and paid
resources. An interactive data mining software tool that can help users visualize and analyze
relationships using publicly accessible data from the Internet is called Maltego. It is a framework
that can rapidly expand the open-source knowledge of a target during a pentest.
Question:
What is Maltego CE?
, Answer:
Community edition of Maltego that ships with Kali Linux and is an interactive data mining software
tool that can help users visualize and analyze relationships using publicly accessible data from the
Internet is called Maltego. It is a framework that can rapidly expand the open-source knowledge of a
target during a pentest.
Question:
What is Shodan?
Answer:
The Shodan search engine scans the entire Internet, parsing banners for services and categorizing
the data returned by each device. The main page provides a search box that can be used to examine
content to find keywords or phrases. Advanced queries enable users to apply filters and boolean
logic operators to drill down into the results. It works similar to a typical web search engine such as
Google, Yahoo, or Bing. Filter example: telnet port:23 country:"US" You can search by service, OS,
product, etc. and it will display the following Top Countries Top Services Top Organizations Top
Operating Systems Top Products The Reports button on the top menu bar provides a quick and
painless way to generate a report based on the search criteria.
Question:
What is Censys?
Answer:
Censys works very much the same way as Shodan, as it allows users to query using keywords and
filters to discover and investigate devices, and to include public-facing IP addresses and domain
names with open ports and services on the Internet. The interface provides an intuitive search
feature that allows the user to query for just about anything, but more specifically ports, protocols,
services, operating systems, locations, etc. Censys data is grouped into three views (categories):
IPv4 Hosts, Top Million Websites, and Certificates. Censys provides additional information and
resources regarding query syntax, example queries (like popular websites without browser trusted
certificates), and data definitions through the help portion of their website. Filter options include:
AS, protocol, and tag Filter example: (telnet) AND protocols.raw: "23/telnet"
Question:
What is a 'WHOIS' search?
