Question 1

A systems administrator works for the U.S. Department of Defense (DoD). She is building out infrastructure to host a new application. Which of the following might she need to reference before ordering any of the hardware to ensure that the hardware and vendor are approved?

Accepted Answer

A)  OEM documentation 
B)  Trusted foundry 
C)  Qualitative risk database 
D)  Vendor framework B

Question 2

The development manager wants to verify that a new application her team developed has been fully hardened. Which of the following might ensure that every part of the application has been tested?

Accepted Answer

A)  White box testing 
B)  Black box testing 
C)  Gray box testing 
D)  Blue box testing A

Question 3

A telecommunications company has split its security team into two teams. One of them is responsible for attacking the company's infrastructure while the other should do everything they can to stop the attack. The management team will coordinate activities with both teams and ensure that there are no ill-timed attacks from outside that are not caught. Which of the following describes the defending team?

Accepted Answer

A)  Blue team 
B)  Gray team 
C)  Red team 
D)  White team A

Question 4

A security engineer has been brought onto a project for a new system containing several critical files that should never change. However, the team needs to be able to know if a file does change. Which of the following solutions would the security engineer most likely recommend?

Accepted Answer

A)  Fingerprinting 
B)  White box 
C)  Sandboxing 
D)  Scoping

Question 5

A threat actor has decided to get revenge on a company that overcharged him for a product he says didn't work. Upon completing a scan of their public-facing network, he finds a list of the services running on the server and decides to look for vulnerabilities in each of the services. He gets a copy of one of the programs he detected, but needs to examine the source code to look for unknown vulnerabilities. Which of the following might allow him to see the source code behind the program?

Accepted Answer

A)  Decompiler 
B)  Fingerprinting 
C)  Sandboxing 
D)  Risk matrix

Question 6

A consultant is hired to analyze some of the most critical and confidential systems in an organization. Which of the following will most likely be necessary as part of the work?

Accepted Answer

A)  SLA 
B)  NDA 
C)  OLA 
D)  HIPAA

Question 7

A security researcher has just been sent a set of files from zero-day malware for analysis. The researcher is concerned about damage to hardware, as the hardware budget for the current fiscal year has been exhausted. Which of the following should the security researcher implement?

Accepted Answer

A)  Trusted foundry 
B)  Fingerprinting 
C)  Decomposition 
D)  Sandboxing

Question 8

The CISO for an organization has called penetration testers that she met at an information security conference a few months ago. The penetration testers come to the office for a meeting and describe the process of how the test would proceed. The testers explain that before they can get started, they need written authorization from the company. Which of the following would outline the authorization, scope, and timing necessary for the penetration testers to begin?

Accepted Answer

A)  NDA 
B)  Risk matrix 
C)  SLA 
D)  Rules for engagement

Question 9

The CISO of an organization wants to determine what real attackers could do if they decided to attack his company. Which of the following types of tests would be the most appropriate to meet the CISO's goals?

Accepted Answer

A)  White box 
B)  Red box 
C)  Black box 
D)  Blue box

Question 10

A large international corporation has hired a penetration tester to determine the extent to which their infrastructure is vulnerable to attacks. In which of the following areas must this company put the most effort and thought, compared with smaller companies?

Accepted Answer

A)  Communication 
B)  Timing 
C)  Authorization 
D)  Exploitation

Question 11

An outside consultant has been hired to perform a risk analysis for a company. As part of the report, he details the likelihood of certain events occurring as well as the impact they would have. Which of the following could he use to display this information in his report?

Accepted Answer

A)  Risk matrix 
B)  Qualitative risk calculation 
C)  Impact analysis 
D)  Quantitative risk calculation

Question 12

The application development manager for an organization has suggested that the company hire a penetration tester to test a new application. The manager suggests that they give the penetration tester some information about the application, but not all of the details. Which of the following describes the type of testing the development manager is suggesting?

Accepted Answer

A)  Gray box 
B)  Gray hat 
C)  Gray team 
D)  Gray scenario

Question 13

A security researcher purchases a discounted open-box item from a local electronics retailer, hoping to learn more about the device. After turning it on and launching the configuration application, he notices that several features appear to be missing, while other features are there that he hadn't heard about. Which of the following would best allow the researcher to verify whether this device has potentially been tampered with?

Accepted Answer

A)  Trusted foundry 
B)  White box testing 
C)  OEM documentation 
D)  Operational control review

Question 14

A security researcher has just purchased a new IoT door lock and wants to determine whether there are any vulnerabilities that the manufacturer may have missed. Which of the following might the researcher use to fully study this product?

Accepted Answer

A)  Sandboxing 
B)  Reverse engineering 
C)  Fingerprinting 
D)  Operational control review

Question 15

Penetration testers have made their way past a company's firewall by exploiting an unpatched vulnerability. They perform a quick ping sweep followed by a port scan so they can determine which services and operating systems may be in the company's environment. An hour into the breach, they get disconnected, and it appears that all of their traffic is being directed to another location when they try to reconnect. Which of the following roles did the penetration tester play in this exercise?

Accepted Answer

A)  White team 
B)  Blue team 
C)  Green team 
D)  Red team

Exam 4: Exploring Penetration Testing

A systems administrator works for the U.S. Department of Defense (DoD) . She is building out infrastructure to host a new application. Which of the following might she need to reference before ordering any of the hardware to ensure that the hardware and vendor are approved?