Penetration Testing Techniques – WGU D484 Study Guide
Administrative controls - correct answer ✔✔security measures implemented to monitor the adherence
to organizational policies and procedures. Those include activities such as hiring and termination
policies, employee training along with creating business continuity and incident response plans.
Physical controls - correct answer ✔✔restrict, detect and monitor access to specific physical areas or
assets. Methods include barriers, tokens, biometrics or other controls such as ensuring the server room
doors are properly locked, along with using surveillance cameras and access cards.
Technical or logical controls - correct answer ✔✔automate protection to prevent unauthorized access or
misuse, and include Access Control Lists (ACL), and Intrusion Detection System (IDS)/ Intrusion
Prevention System (IPS) signatures and antimalware protection that are implemented as a system
hardware, software, or firmware solution.
What is the primary goal of PenTesting? - correct answer ✔✔Reduce overall risk by taking proactive
steps to reduce vulnerabilities.
Principle of Least Privilege - correct answer ✔✔Basic principle of security stating that something should
be allocated the minimum necessary rights, privileges, or information to perform its role.
Risk - correct answer ✔✔Likelihood and impact (or consequence) of a threat actor exercising a
vulnerability.
Threat - correct answer ✔✔represents something such as malware or a natural disaster, that can
accidentally or intentionally exploit a vulnerability and cause undesirable results.
Vulnerability - correct answer ✔✔is a weakness or flaw, such as a software bug, system flaw, or human
error. A vulnerability can be exploited by a threat
Risk Analysis - correct answer ✔✔is a security process used to assess risk damages that can affect an
organization.
,Unified Threat Management (UTM) - correct answer ✔✔All-in-one security appliances and agents that
combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data loss
prevention, content filtering, and so on.
Main steps of the structured PenTesting Process: - correct answer ✔✔Planning and scoping,
Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks, Analysis, Reporting
Unauthorized Hacker - correct answer ✔✔A hacker operating with malicious intent.
Payment Card Industry Data Security Standard (PCI DSS) - correct answer ✔✔Information security
standard for organizations that process credit or bank card payments.
An organization must do the following in order to protect cardholder data: - correct answer ✔✔Maintain
secure infrastructure using dedicated appliances and software to monitor and prevent attacks.
Implement best practices like changing default passwords, educating users on email safety, and
continuously monitoring for vulnerabilities with updated anti-malware protection. Enforce strict access
controls through the principle of least privilege and regularly test and monitor networks.
PCI DSS Level 1 - correct answer ✔✔Large merchant with over six million transactions a year and
external auditor by a Qualified Security Assessor (QSA), must complete a RoC.
PCI DSS Level 2 - correct answer ✔✔merchant with one to six million transactions a year, must complete
a RoC.
PCI DSS Level 3 - correct answer ✔✔merchant with 20000 to one million transactions a year
PCI DSS Level 4 - correct answer ✔✔small merchant with under 20000 transactions a year
General Data Protection Regulation (GDPR) - correct answer ✔✔Provisions and requirements protecting
the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single
Market are restricted unless protected by like-for-like regulations, such as the US's Privacy Shield
requirements.
, GDRP Components: - correct answer ✔✔Require consent, Rescind Consent, Global reach, Restrict data
collection, Violation reporting
Stop Hacks and Improve Electronic Data Security (SHIELD) - correct answer ✔✔is a law that was enacted
in New York state in March 2020 to protect citizens data. The law requires companies to bolster their
cybersecurity defense methods to prevent a data breach and protect consumer data.
California Consumer Privacy Act (CCPA) - correct answer ✔✔was enacted in 2020 and outlines specific
guidelines on how to appropriately handle consumer data. To ensure that customer data is adequately
protected, vendors should include PenTesting of all web applications, internal systems along with social
engineering assessments.
Health Insurance Portability and Accountability Act (HIPAA) - correct answer ✔✔is a law that mandates
rigorous requirements for anyone that deals with patient information. Computerized electronic patient
records are referred to as electronic protected health information (e-PHI). With HIPAA, the e-PHI of any
patient must be protected from exposure, or the organization can face a hefty fine.
Open Web Application Security Project (OWASP) - correct answer ✔✔A charity and community
publishing a number of secure application development resources.
NIST - correct answer ✔✔Develops computer security standards used by US federal agencies and
publishes cybersecurity best practice guides and research.
Open-source Security Testing Methodology Manual (OSSTMM) - correct answer ✔✔Developed by the
Institute for Security and Open Methodologies (ISECOM), this manual outlines every area of an
organization that needs testing, as well as goes into details about how to conduct the relevant tests.
Penetration Testing Execution Standard (PTES) - correct answer ✔✔A standard established in 2009 that
covers seven areas of penetration testing and includes an accompanying technical guide.
Common Vulnerability Scoring System (CVSS) - correct answer ✔✔A risk management approach to
quantifying vulnerability data and then taking into account the degree of risk to different types of
systems or information.
Administrative controls - correct answer ✔✔security measures implemented to monitor the adherence
to organizational policies and procedures. Those include activities such as hiring and termination
policies, employee training along with creating business continuity and incident response plans.
Physical controls - correct answer ✔✔restrict, detect and monitor access to specific physical areas or
assets. Methods include barriers, tokens, biometrics or other controls such as ensuring the server room
doors are properly locked, along with using surveillance cameras and access cards.
Technical or logical controls - correct answer ✔✔automate protection to prevent unauthorized access or
misuse, and include Access Control Lists (ACL), and Intrusion Detection System (IDS)/ Intrusion
Prevention System (IPS) signatures and antimalware protection that are implemented as a system
hardware, software, or firmware solution.
What is the primary goal of PenTesting? - correct answer ✔✔Reduce overall risk by taking proactive
steps to reduce vulnerabilities.
Principle of Least Privilege - correct answer ✔✔Basic principle of security stating that something should
be allocated the minimum necessary rights, privileges, or information to perform its role.
Risk - correct answer ✔✔Likelihood and impact (or consequence) of a threat actor exercising a
vulnerability.
Threat - correct answer ✔✔represents something such as malware or a natural disaster, that can
accidentally or intentionally exploit a vulnerability and cause undesirable results.
Vulnerability - correct answer ✔✔is a weakness or flaw, such as a software bug, system flaw, or human
error. A vulnerability can be exploited by a threat
Risk Analysis - correct answer ✔✔is a security process used to assess risk damages that can affect an
organization.
,Unified Threat Management (UTM) - correct answer ✔✔All-in-one security appliances and agents that
combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data loss
prevention, content filtering, and so on.
Main steps of the structured PenTesting Process: - correct answer ✔✔Planning and scoping,
Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks, Analysis, Reporting
Unauthorized Hacker - correct answer ✔✔A hacker operating with malicious intent.
Payment Card Industry Data Security Standard (PCI DSS) - correct answer ✔✔Information security
standard for organizations that process credit or bank card payments.
An organization must do the following in order to protect cardholder data: - correct answer ✔✔Maintain
secure infrastructure using dedicated appliances and software to monitor and prevent attacks.
Implement best practices like changing default passwords, educating users on email safety, and
continuously monitoring for vulnerabilities with updated anti-malware protection. Enforce strict access
controls through the principle of least privilege and regularly test and monitor networks.
PCI DSS Level 1 - correct answer ✔✔Large merchant with over six million transactions a year and
external auditor by a Qualified Security Assessor (QSA), must complete a RoC.
PCI DSS Level 2 - correct answer ✔✔merchant with one to six million transactions a year, must complete
a RoC.
PCI DSS Level 3 - correct answer ✔✔merchant with 20000 to one million transactions a year
PCI DSS Level 4 - correct answer ✔✔small merchant with under 20000 transactions a year
General Data Protection Regulation (GDPR) - correct answer ✔✔Provisions and requirements protecting
the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single
Market are restricted unless protected by like-for-like regulations, such as the US's Privacy Shield
requirements.
, GDRP Components: - correct answer ✔✔Require consent, Rescind Consent, Global reach, Restrict data
collection, Violation reporting
Stop Hacks and Improve Electronic Data Security (SHIELD) - correct answer ✔✔is a law that was enacted
in New York state in March 2020 to protect citizens data. The law requires companies to bolster their
cybersecurity defense methods to prevent a data breach and protect consumer data.
California Consumer Privacy Act (CCPA) - correct answer ✔✔was enacted in 2020 and outlines specific
guidelines on how to appropriately handle consumer data. To ensure that customer data is adequately
protected, vendors should include PenTesting of all web applications, internal systems along with social
engineering assessments.
Health Insurance Portability and Accountability Act (HIPAA) - correct answer ✔✔is a law that mandates
rigorous requirements for anyone that deals with patient information. Computerized electronic patient
records are referred to as electronic protected health information (e-PHI). With HIPAA, the e-PHI of any
patient must be protected from exposure, or the organization can face a hefty fine.
Open Web Application Security Project (OWASP) - correct answer ✔✔A charity and community
publishing a number of secure application development resources.
NIST - correct answer ✔✔Develops computer security standards used by US federal agencies and
publishes cybersecurity best practice guides and research.
Open-source Security Testing Methodology Manual (OSSTMM) - correct answer ✔✔Developed by the
Institute for Security and Open Methodologies (ISECOM), this manual outlines every area of an
organization that needs testing, as well as goes into details about how to conduct the relevant tests.
Penetration Testing Execution Standard (PTES) - correct answer ✔✔A standard established in 2009 that
covers seven areas of penetration testing and includes an accompanying technical guide.
Common Vulnerability Scoring System (CVSS) - correct answer ✔✔A risk management approach to
quantifying vulnerability data and then taking into account the degree of risk to different types of
systems or information.
