The boundaries between digital vulnerabilities and physical warfare are dissolving before our eyes. Ukrainian forces have dramatically shifted military paradigms by marrying cybersecurity breaches with commercial drone attacks against strategic Russian targets like Tupolev aircraft manufacturers. This evolution demands security professionals develop capabilities far beyond traditional network defense – a stark reminder that our field continues expanding into unexpected territories.
Security testing forms the foundation of effective defense, and distinguishing between key methodologies is crucial both for the CISSP exam and real-world implementation. Vulnerability assessments detect weaknesses, while penetration tests exploit them to demonstrate actual impact. When evaluating your security testing approach, consider the perspective advantage: internal testing reveals different vulnerabilities than external probing, each simulating distinct attacker vantage points. False negatives represent perhaps the greatest danger in security testing – providing a dangerous illusion of safety while leaving actual vulnerabilities unaddressed.
Testing approaches vary in depth and disclosure level. Black box testing simulates external attacks with no prior system knowledge. White box testing grants complete access to internal architecture. Gray box testing offers a middle ground with partial system information – a cost-effective approach for organizations with tighter budgets. Red teams validate incident response plans through realistic attack simulations, while authenticated scans reveal vulnerabilities that exist beyond login barriers. By mastering these concepts for Domain 6.2, you'll build essential knowledge that translates directly to creating more secure environments and passing your CISSP exam the first time. Join us at CISSP Cyber Training for free practice questions and comprehensive preparation resources to accelerate your cybersecurity career.
Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Welcome to the CISSP Cyber Training Podcast, where we
provide you the training andtools you need to pass the CISSP
exam the first time.
Hi, my name is Sean Gerber andI'm your host for this
action-packed, informativepodcast.
Join me each week as I providethe information you need to pass
the CISSP exam and grow yourcybersecurity knowledge.
(00:20):
All right, let's get started,let's go.
Let's go.
Cybersecurity knowledge.
All right, let's get started.
Good morning everybody.
It's Sean Gerber with CISSPCyber Training, and hope you all
are having a beautifullyblessed day today.
Today is what?
Cissp Question Thursday?
So we are going to be goingover some CISSP questions
related to the domain 6.2.1, andthat was based on the content
(00:43):
that we had on Monday, so youare pretty excited about that.
I said E.
I don't know why I said E.
We, we, we.
I we're excited about havingsome questions related to 6.2.
But before we get started, onething I wanted to kind of bring
up was there's just a recentarticle I saw in the register
related to the Ukraine attacksthat occurred.
(01:04):
Now, obviously, geopoliticalstuff we don't really
necessarily get into the CISSP,but we kind of talk about
hacking and dealing with thosetypes of activities.
But if you all have been seeingthe news.
The Ukrainians have changed theway warfare is being done and
they're actually.
It's very interesting how thishas changed and, coming from my
background with being in themilitary and flying bombers and
(01:25):
just really intelligence, allthose pieces around the military
apparatus, this whole newparadigm now of drones being
launched from, basically,containers around the different
country of Russia and attackingthese very strategic points.
Now I say all that with thething that how it's changed, in
that it is now we callasymmetric warfare and now the
(01:49):
Ukrainians are attacking theTupolev, basically the aircraft
manufacturers, the bomb makers,bomber makers within Russia, and
part of this was around thefact that they were able to get
access to all kinds of personaldata, resumes, purchase records,
you name it of the Tupolev typeactivities like the corporation
, and they're the ones that makethe bombers for the Russian
(02:11):
military.
So the point I'm trying tobring up around that is nothing
is safe and if you are the waythe world has changed, thinking
it's going to be big countryagainst big country, well, now
you're seeing how Ukrainians areattacking the Russians in a way
very similar to the AmericanRevolution, in more of a
guerrilla warfare typeactivities, but they're using
(02:32):
things that are very interesting, and also commercial,
off-the-shelf equipment that isrelatively inexpensive in
relationship to the things thatthey are blowing up.
And so the point of it is isthat with between hacking that
occurring and physicaldestruction that is occurring,
we are seeing a completeparadigm shift in relation to
(02:52):
warfare.
So I'd just say all that tokind of talk about the fact that
if you, as you are incybersecurity, your world is
just really expanding beyondwhat we first started at least
what I first started back in theearly 2000s.
It has just gone way off thecharts and we kind of had
suspicions it was going to endup kind of going down this path.
(03:12):
But now, with the way thedrones have taken place and now
that the ability for people tohave activities in a way that is
just totally out of theparadigm shifts or out of the
thought process, this is goingto be an interesting, very
interesting place that we end upgoing in the future.
So, as a security professional,you are going to have to learn
how to deal with all kinds ofthings that you probably at
(03:34):
least I never had to learn whenI was just getting started in
security.
So it's pretty cool.
It's very interesting, verydynamic and can be very
challenging depending upon whatside of the fence you're on.
But again, that's all I wantedto kind of talk about here.
Again, they talk about theUkrainian strikes, striking bomb
makers or bomber makers with ahack attack and the fact that
they were able to get access tothe Tupolev Aircraft
(03:56):
Manufacturing Company.
Now let's move on to some of thequestions we have for today.
Okay, so these are thequestions you're going to have
in the CISSP cyber training.
If you head over there, you canget access to all these
questions that are available toyou, and the point of it is is
to help you kind of guide youthrough the various questions
and so that you can be betterprepared for the CISSP exam.
So we're going to start rollingthrough some of the questions,
(04:18):
again related to domain 6.2.
Okay, question one which of thefollowing describes the primary
goal of a vulnerabilityassessment?
A to identify weaknesses insystems and security controls
that could be exploited bythreats.
B to exploit identifiedweaknesses and gain unauthorized
access to systems.
(04:38):
C to determine the financialimpact of a successful cyber
attack.
Or D to continuously monitornetwork traffic for malicious
activity?
And the answer is A to identifyweaknesses in systems and
security controls that could beexploited by potential threats.
Again, vulnerabilityassessments are a very important
part of any organization.
(04:59):
You need to consider doing them.
Question two a securityprofessional is conducting a
vulnerability scan of a webapplication.
The scan reports a highseverity vulnerability, but upon
manual verification it isdetermined that the
vulnerability does not actuallyexist.
Okay, this scenario is anexample of what A a true
positive, b a false negative, ca true negative or D a false
(05:23):
positive.
So again, basically a scan theweb application and it comes
back and says yes, there's aproblem, but upon further
discovery it is not a problem.
So the answer is a falsepositive.
D right, false positives occura lot.
They can happen with securitytools and therefore it's
important for you to tune andtrain these tools so that your
false positive rate goes down.
Important for you to tune andtrain these tools so that your
(05:44):
false positive rate goes down.
Question three which of thefollowing components of a
security content automationprotocol SCAP SCAP provides the
standardized scoring system fordescribing the severity of
security vulnerabilities.
Again, which of the followingcomponents of the SCAP provides
a standardized scoring systemfor describing the severity of
your security vulnerabilities ACommon Vulnerabilities and
(06:07):
Exposure.
B Common Configuration andEnumeration, cce, c Common
Vulnerability Scoring System,cvss, or D Open Vulnerability
and Assessment Language, oval.
And the answer is C Right,common Vulnerability Scoring
System.
And the answer is C Right,common Vulnerability Scoring
System.
The Common VulnerabilityScoring System, or CVSS, is free
(06:29):
and open industry standard forassessing the severity of a
computer system securityvulnerabilities.
Cves you hear a lot about, theyprovide the naming system, cces
are the configuration issuesand OVL is for describing test
procedures.
Question four A penetration test, where the testers have no
prior knowledge of the targetsystem's internal structure,
network diagrams or source code,is known as what?
(06:52):
Again, a penetration test.
The testers have no priorknowledge of target systems,
internal structures or networkdiagrams.
What is this called?
A white box testing, c blackbox testing, c gray box testing
or D crystal box testing,testing not texting testing.
And the answer is B black boxtesting, right, it simulates an
(07:12):
external attacker's perspectiveand they're testing no internal
knowledge of this target system.
The goal is, then, is you'dhave no idea, you're just going
in to see what is there, andthis is really an approach where
the system defenses determinehow, what would happen, what
would be encountered and soforth.
So that is what they call blackbox testing.
Question five during which phaseof a penetration test would an
(07:33):
ethical hacker actively gatherinformation about a target by
interacting with live systemssuch as port scanning and
service enumeration?
Again, during which phase ofthe penetration test would a
ethical hacker activity gatherinformation about a target by
interacting with live systemssuch as port scanning and
service enumeration?
A Reconnaissance, bVulnerability analysis, c
(07:57):
Exploitation or D Enumeration?
And the answer is D Enumeration.
That is the active phase ofinformation gathering, where the
tester is directly interactingwith the target, trying to
figure out information what'sopen, what ports are open, what
user accounts are available,network details and so on.
So that is what they callenumeration.
Question six which type ofsecurity control testing
(08:19):
involves conducting assessmentsusing valid key point here valid
credentials allowing thescanner to simulate the actions
of an authenticated user?
Okay, so which type of securitycontrol testing involves
conducting assessments usingvalid credentials allowing the
scanner to simulate the actionsof an authenticated user?
A authenticated scan, b networkdiscovery scan, c web
(08:43):
application scan or D anauthenticated scan?
Hmm, I wonder what that one isright Authenticated user
credentials.
It is D authenticated scan andauthenticated scan.
Obviously, they also call thatwhat they call a credential scan
.
It allows the tool to log intothe target and the application
and, with legitimate credentials, to then therefore and see what
(09:04):
can actually it can find.
Many unauthenticated scansreally don't give you a whole
lot of information.
So one of the aspects you'llwant to consider when doing
scanning is an authenticatedscan.
If you don't have it in placenow, I would highly recommend
that you do that, because it'sgoing to give you a much better
reading of what are thevulnerabilities behind the
authentication.
Question seven which of thefollowing is a key objective of
(09:27):
security control testing?
A to validate the effectivenessof implemented security
controls.
B to simulate all securityrisks from an organization.
C to ensure 100 uptime for allcritical systems.
Or.
D to automate all incidentresponse procedures.
Again, which of the followingis a key objective for security
control testing?
And the answer is a to validatethe effectiveness of for
(09:47):
security control testing.
And the answer is A to validatethe effectiveness of
implemented security controls,right?
So when you're looking atunderstanding what's going on of
the objective of a securitycontrol testing, you wanna find
out which ones are actuallyvalid and you validate these and
their effectiveness throughusing these various types of
scanning capabilities, andthat's really the main function
of it.
So you wanna test the controls,you put controls in place, you.
(10:07):
So you want to test thecontrols.
You put controls in place, youwant to be able to test them and
that is the ultimate goalaround security control testing.
Question eight security team isreviewing the logs for
suspicious activity afterreported incident.
The activity falls under whichaspect of security control
testing?
A pen testing, c log review andanalysis, c vulnerability
assessments or D code review.
(10:29):
Again, security team isreviewing the logs.
What are they doing?
What does this fall under?
It falls under B log review andanalysis.
So log reviews and analysis area crucial part of any sort of
security control testing andsecurity operations.
It involves looking at theapplication logs and systems and
so forth.
It's a very important part andyou should consider doing it.
(10:50):
Question nine when performing apenetration test, the phase
where the tester attempts togain control of a system or
escalate privileges usingidentified vulnerabilities is
known as what?
A reconnaissance, b enumeration, c vulnerability analysis or D
exploitation vulnerabilityanalysis or de-exploitation.
Again, performing pen tests,what phase of the tester
attempts to gain control of thesystem or escalate privileges
(11:11):
using identified vulnerabilitiesis known as de-exploitation.
Exploitation is the phase wherethe pen tester actively
attempts to leverage thevulnerabilities that they've
been able to find against acompromised system and this
basically comes down to isthey're trying to achieve a
predefined objective by gainingunauthorized access.
That's the ultimate goal.
(11:32):
Question 10, which of thefollowing is a significant
drawback of a false negative ina security assessment and
testing?
A it leads to unnecessaryremediation efforts and extreme
costs.
B it provides false sense ofsecurity, leaving the actual
vulnerabilities unaddressed.
C it provides false sense ofsecurity, leaving the actual
vulnerabilities unaddressed.
C it indicates a vulnerabilitywhere what the it indicates a
vulnerability was detectedcorrectly.
(11:53):
Or.
D it overestimates the truesecurity posture of the system.
Again, which is the followingsignificant drawback of a false
negative?
It is B it provides a falsesense of security, leaving the
actual vulnerabilities addressed.
So basically, a false negativesays hey, you're good, you're
good to go, no worries, mate,everything's fine, but in
reality, yeah, you have aproblem.
So false negative can lead youdown the path of thinking
(12:16):
everything is all hunky-dory.
Question 11, which is the maindifference between a
vulnerability assessment and apenetration test?
We've talked about a lot aboutthis on CISSP Cyber Training.
So what's the differencebetween a vulnerability
assessment and a pen test?
A the vulnerability assessmentactively exploits weaknesses,
while the pen test onlyidentifies them.
B a vulnerability assessment isa continuous process, while pen
(12:40):
testing is a one-time event.
C a vulnerability assessmentfocuses on identifying
weaknesses, while the pen testattempts to exploit them to
demonstrate the overall impact.
Or D a vulnerability assessmentrequires specialized tools,
while pen tests can be donemanually.
And the answer is C Rightvulnerability assessments.
They focus on findingweaknesses and pen tests are
(13:01):
designed to exploit thoseweaknesses and to show I own the
castle, right.
The vulnerability assessmentshows, says to you oh yes, the
castle could be broken into.
The pen test says I'm justgoing to kick the door down and
walk right.
In Question 12, the securityteam is discussing various
approaches for testing a newapplication.
They decide to provide thetesters with some internal
(13:22):
knowledge of the application'sarchitecture and source code.
That's pretty interesting, butnot full access.
This approach is best describedas what?
A black box testing, b whitebox testing, c gray box testing.
Or D red team's assessments.
And the answer is C it's a graybox testing.
(13:42):
Basically, you're getting someelements from the black and
white box and it gives you alittle bit of insight into
what's actually going on.
It does allow you to getfurther into the organization
and it helps you kind of.
And it really is a good thingif you are on a tighter budget
and you want to be able just tosee what they can find, but you
want to not have them waste abunch of time trying to kick the
door the front door in.
(14:02):
So I would highly recommendgray box testing.
It's used, it.
It's a much more cost-efficientapproach.
But you just got to determinewhat are the needs for you and
your organization.
Question 13, which of thefollowing best describes the
purpose of a commonvulnerabilities and exposures
CVE system?
Again, what's the followingbest describes the purpose of a
common vulnerabilities andexposures system?
(14:25):
A to provide naming system forpublicly known cybersecurity
vulnerabilities and exposuressystem.
A to provide naming system forpublicly known cybersecurity
vulnerabilities and exposures.
B to provide a common languagefor describing security testing
procedures.
C to standards for scoring avulnerability severity.
Or.
D to define securityconfiguration checklists.
Again, which of the followingbest describes a purpose of a
common vulnerabilities and theCVE system?
(14:47):
And the answer is A to providea naming system for publicly
known cybersecurityvulnerabilities and exposures.
So it's basically a publiclydisclosed list that has
different vulnerabilities andthey have names.
To those, it provides uniqueidentifiers so you know which
one it is, and they then alsowork in coordination with the
various vulnerability managementteams to ensure that you are
(15:08):
properly being protected.
Question 14, when designing asecurity control testing
strategy, what is thesignificance of air quotes
perspective, more or lessinternal versus external testing
?
So, the perspective, what isthe benefit, the significance of
that?
A it determines the cost of thetesting engagement.
B it influences the tools andtechniques used during the test.
(15:30):
C, it dictates the reportingformat of the test results.
Or, d, it defines the scope andpotential impact of the
findings by simulating differentattacker vantage points.
Air quotes, perspective, right?
So again, what is designing asecurity control testing
strategy?
What is the significance ofperspective internal versus
external testing?
(15:50):
And the answer is D.
It defines the scope andpotential impact of the findings
by simulating different attackvantage points.
The ultimate point is just whatis it like if you get into the
environment from an internalperspective and what happens if
you're just trying to get bangon the door from the outside?
What are the different kind ofcontrol mechanisms and how are
they working depending upon yourperspective in the network?
(16:13):
Question 15, what is the primarypurpose of red team exercise in
a security control testing.
Again, what is the primarypurpose of a red team exercise
in security control testing?
A to validate the effectivenessof an incident response plan by
simulating realistic attacks.
B to perform automatedvulnerability scans on an
(16:33):
organization's network.
C to provide recommendationsfor security policy updates.
Or.
D to train the securityoperations center analysts on
new specific tools.
So what is the primary purposeof a red team?
It is A is to validate theeffectiveness of your incident
response plan and by simulatingpotentially real attacks, the
goal is, if you have a red teamthat you're banging on the door,
(16:55):
they want to see how does yourIR team respond to these banging
on the door.
It might just be a tap, so dothey hear you tapping?
And then you have to tap alittle louder and you tap a
little louder until eventuallythe IR team scrambles to their
feet and goes and addresses theissue.
Right, that's the purpose of ared team Now that and they also
are used for helping they do pentesting, and not necessarily
(17:17):
they may work a little bit withthe red or with your incident
response teams to do kind ofthey call it purple teaming,
where you would actually thenteach some of the folks while
they're trying to break in.
I highly recommend that.
It's a really good thing if youcan do it, but, that being said
, that's the purpose of a redteam.
Okay, so go to CISSP CyberTraining head over there.
Get some free content.
(17:38):
There's tons of stuff there.
There's also some stuff thatyou get.
I mean, honestly, it's a fairprice.
You go and you buy what I havethere on CISSP Cyber Training.
It is fair.
Getting your CISSP is expensive,but if you don't want to spend
the time to go to it or don'thave the money and don't want to
go to a boot camp, the CISSPCyber Trainings program is
(17:58):
amazing.
It will help you and yes, I ambiased, of course, because I
created it.
But, that being said, it willhelp you and it's the cheapest
amount of money that you willever spend to get your CISSP.
The only difference is you gotto do the work.
It's a self-study program.
Now we have also other tiersthat are available to do
mentorship and other ways that Ican help you, but bottom line
(18:20):
is that you can get all thetraining you need If you're
studying for the CISSP.
Go to CISSP Cyber Training andget access to it now.
All right.
I hope you all have a wonderful, wonderful day and we will
catch you all on the flip side,see ya.
Thanks so much for joining metoday on my podcast.
If you like what you heard,please leave a review on iTunes,
as I would greatly appreciateyour feedback.
Also, check out my videos thatare on YouTube and just head to
(18:42):
my channel at CISSP cybertraining and you will find a
plethora, or a cornucopia, ofcontent to help you pass the
CISSP exam the first time.
Lastly, head to CISSP CyberTraining and sign up for 360
free CISSP questions to help youin your CISSP journey.
Thanks again for listening.
Welcome to the CISSP Cyber Training Podcast, where we
provide you the training andtools you need to pass the CISSP
exam the first time.
Hi, my name is Sean Gerber andI'm your host for this
action-packed, informativepodcast.
Join me each week as I providethe information you need to pass
the CISSP exam and grow yourcybersecurity knowledge.
(00:20):
All right, let's get started,let's go.
Let's go.
Cybersecurity knowledge.
All right, let's get started.
Good morning everybody.
It's Sean Gerber with CISSPCyber Training, and hope you all
are having a beautifullyblessed day today.
Today is what?
Cissp Question Thursday?
So we are going to be goingover some CISSP questions
related to the domain 6.2.1, andthat was based on the content
(00:43):
that we had on Monday, so youare pretty excited about that.
I said E.
I don't know why I said E.
We, we, we.
I we're excited about havingsome questions related to 6.2.
But before we get started, onething I wanted to kind of bring
up was there's just a recentarticle I saw in the register
related to the Ukraine attacksthat occurred.
(01:04):
Now, obviously, geopoliticalstuff we don't really
necessarily get into the CISSP,but we kind of talk about
hacking and dealing with thosetypes of activities.
But if you all have been seeingthe news.
The Ukrainians have changed theway warfare is being done and
they're actually.
It's very interesting how thishas changed and, coming from my
background with being in themilitary and flying bombers and
(01:25):
just really intelligence, allthose pieces around the military
apparatus, this whole newparadigm now of drones being
launched from, basically,containers around the different
country of Russia and attackingthese very strategic points.
Now I say all that with thething that how it's changed, in
that it is now we callasymmetric warfare and now the
(01:49):
Ukrainians are attacking theTupolev, basically the aircraft
manufacturers, the bomb makers,bomber makers within Russia, and
part of this was around thefact that they were able to get
access to all kinds of personaldata, resumes, purchase records,
you name it of the Tupolev typeactivities like the corporation
, and they're the ones that makethe bombers for the Russian
(02:11):
military.
So the point I'm trying tobring up around that is nothing
is safe and if you are the waythe world has changed, thinking
it's going to be big countryagainst big country, well, now
you're seeing how Ukrainians areattacking the Russians in a way
very similar to the AmericanRevolution, in more of a
guerrilla warfare typeactivities, but they're using
(02:32):
things that are very interesting, and also commercial,
off-the-shelf equipment that isrelatively inexpensive in
relationship to the things thatthey are blowing up.
And so the point of it is isthat with between hacking that
occurring and physicaldestruction that is occurring,
we are seeing a completeparadigm shift in relation to
(02:52):
warfare.
So I'd just say all that tokind of talk about the fact that
if you, as you are incybersecurity, your world is
just really expanding beyondwhat we first started at least
what I first started back in theearly 2000s.
It has just gone way off thecharts and we kind of had
suspicions it was going to endup kind of going down this path.
(03:12):
But now, with the way thedrones have taken place and now
that the ability for people tohave activities in a way that is
just totally out of theparadigm shifts or out of the
thought process, this is goingto be an interesting, very
interesting place that we end upgoing in the future.
So, as a security professional,you are going to have to learn
how to deal with all kinds ofthings that you probably at
(03:34):
least I never had to learn whenI was just getting started in
security.
So it's pretty cool.
It's very interesting, verydynamic and can be very
challenging depending upon whatside of the fence you're on.
But again, that's all I wantedto kind of talk about here.
Again, they talk about theUkrainian strikes, striking bomb
makers or bomber makers with ahack attack and the fact that
they were able to get access tothe Tupolev Aircraft
(03:56):
Manufacturing Company.
Now let's move on to some of thequestions we have for today.
Okay, so these are thequestions you're going to have
in the CISSP cyber training.
If you head over there, you canget access to all these
questions that are available toyou, and the point of it is is
to help you kind of guide youthrough the various questions
and so that you can be betterprepared for the CISSP exam.
So we're going to start rollingthrough some of the questions,
(04:18):
again related to domain 6.2.
Okay, question one which of thefollowing describes the primary
goal of a vulnerabilityassessment?
A to identify weaknesses insystems and security controls
that could be exploited bythreats.
B to exploit identifiedweaknesses and gain unauthorized
access to systems.
(04:38):
C to determine the financialimpact of a successful cyber
attack.
Or D to continuously monitornetwork traffic for malicious
activity?
And the answer is A to identifyweaknesses in systems and
security controls that could beexploited by potential threats.
Again, vulnerabilityassessments are a very important
part of any organization.
(04:59):
You need to consider doing them.
Question two a securityprofessional is conducting a
vulnerability scan of a webapplication.
The scan reports a highseverity vulnerability, but upon
manual verification it isdetermined that the
vulnerability does not actuallyexist.
Okay, this scenario is anexample of what A a true
positive, b a false negative, ca true negative or D a false
(05:23):
positive.
So again, basically a scan theweb application and it comes
back and says yes, there's aproblem, but upon further
discovery it is not a problem.
So the answer is a falsepositive.
D right, false positives occura lot.
They can happen with securitytools and therefore it's
important for you to tune andtrain these tools so that your
false positive rate goes down.
Important for you to tune andtrain these tools so that your
(05:44):
false positive rate goes down.
Question three which of thefollowing components of a
security content automationprotocol SCAP SCAP provides the
standardized scoring system fordescribing the severity of
security vulnerabilities.
Again, which of the followingcomponents of the SCAP provides
a standardized scoring systemfor describing the severity of
your security vulnerabilities ACommon Vulnerabilities and
(06:07):
Exposure.
B Common Configuration andEnumeration, cce, c Common
Vulnerability Scoring System,cvss, or D Open Vulnerability
and Assessment Language, oval.
And the answer is C Right,common Vulnerability Scoring
System.
And the answer is C Right,common Vulnerability Scoring
System.
The Common VulnerabilityScoring System, or CVSS, is free
(06:29):
and open industry standard forassessing the severity of a
computer system securityvulnerabilities.
Cves you hear a lot about, theyprovide the naming system, cces
are the configuration issuesand OVL is for describing test
procedures.
Question four A penetration test, where the testers have no
prior knowledge of the targetsystem's internal structure,
network diagrams or source code,is known as what?
(06:52):
Again, a penetration test.
The testers have no priorknowledge of target systems,
internal structures or networkdiagrams.
What is this called?
A white box testing, c blackbox testing, c gray box testing
or D crystal box testing,testing not texting testing.
And the answer is B black boxtesting, right, it simulates an
(07:12):
external attacker's perspectiveand they're testing no internal
knowledge of this target system.
The goal is, then, is you'dhave no idea, you're just going
in to see what is there, andthis is really an approach where
the system defenses determinehow, what would happen, what
would be encountered and soforth.
So that is what they call blackbox testing.
Question five during which phaseof a penetration test would an
(07:33):
ethical hacker actively gatherinformation about a target by
interacting with live systemssuch as port scanning and
service enumeration?
Again, during which phase ofthe penetration test would a
ethical hacker activity gatherinformation about a target by
interacting with live systemssuch as port scanning and
service enumeration?
A Reconnaissance, bVulnerability analysis, c
(07:57):
Exploitation or D Enumeration?
And the answer is D Enumeration.
That is the active phase ofinformation gathering, where the
tester is directly interactingwith the target, trying to
figure out information what'sopen, what ports are open, what
user accounts are available,network details and so on.
So that is what they callenumeration.
Question six which type ofsecurity control testing
(08:19):
involves conducting assessmentsusing valid key point here valid
credentials allowing thescanner to simulate the actions
of an authenticated user?
Okay, so which type of securitycontrol testing involves
conducting assessments usingvalid credentials allowing the
scanner to simulate the actionsof an authenticated user?
A authenticated scan, b networkdiscovery scan, c web
(08:43):
application scan or D anauthenticated scan?
Hmm, I wonder what that one isright Authenticated user
credentials.
It is D authenticated scan andauthenticated scan.
Obviously, they also call thatwhat they call a credential scan
.
It allows the tool to log intothe target and the application
and, with legitimate credentials, to then therefore and see what
(09:04):
can actually it can find.
Many unauthenticated scansreally don't give you a whole
lot of information.
So one of the aspects you'llwant to consider when doing
scanning is an authenticatedscan.
If you don't have it in placenow, I would highly recommend
that you do that, because it'sgoing to give you a much better
reading of what are thevulnerabilities behind the
authentication.
Question seven which of thefollowing is a key objective of
(09:27):
security control testing?
A to validate the effectivenessof implemented security
controls.
B to simulate all securityrisks from an organization.
C to ensure 100 uptime for allcritical systems.
Or.
D to automate all incidentresponse procedures.
Again, which of the followingis a key objective for security
control testing?
And the answer is a to validatethe effectiveness of for
(09:47):
security control testing.
And the answer is A to validatethe effectiveness of
implemented security controls,right?
So when you're looking atunderstanding what's going on of
the objective of a securitycontrol testing, you wanna find
out which ones are actuallyvalid and you validate these and
their effectiveness throughusing these various types of
scanning capabilities, andthat's really the main function
of it.
So you wanna test the controls,you put controls in place, you.
(10:07):
So you want to test thecontrols.
You put controls in place, youwant to be able to test them and
that is the ultimate goalaround security control testing.
Question eight security team isreviewing the logs for
suspicious activity afterreported incident.
The activity falls under whichaspect of security control
testing?
A pen testing, c log review andanalysis, c vulnerability
assessments or D code review.
(10:29):
Again, security team isreviewing the logs.
What are they doing?
What does this fall under?
It falls under B log review andanalysis.
So log reviews and analysis area crucial part of any sort of
security control testing andsecurity operations.
It involves looking at theapplication logs and systems and
so forth.
It's a very important part andyou should consider doing it.
(10:50):
Question nine when performing apenetration test, the phase
where the tester attempts togain control of a system or
escalate privileges usingidentified vulnerabilities is
known as what?
A reconnaissance, b enumeration, c vulnerability analysis or D
exploitation vulnerabilityanalysis or de-exploitation.
Again, performing pen tests,what phase of the tester
attempts to gain control of thesystem or escalate privileges
(11:11):
using identified vulnerabilitiesis known as de-exploitation.
Exploitation is the phase wherethe pen tester actively
attempts to leverage thevulnerabilities that they've
been able to find against acompromised system and this
basically comes down to isthey're trying to achieve a
predefined objective by gainingunauthorized access.
That's the ultimate goal.
(11:32):
Question 10, which of thefollowing is a significant
drawback of a false negative ina security assessment and
testing?
A it leads to unnecessaryremediation efforts and extreme
costs.
B it provides false sense ofsecurity, leaving the actual
vulnerabilities unaddressed.
C it provides false sense ofsecurity, leaving the actual
vulnerabilities unaddressed.
C it indicates a vulnerabilitywhere what the it indicates a
vulnerability was detectedcorrectly.
(11:53):
Or.
D it overestimates the truesecurity posture of the system.
Again, which is the followingsignificant drawback of a false
negative?
It is B it provides a falsesense of security, leaving the
actual vulnerabilities addressed.
So basically, a false negativesays hey, you're good, you're
good to go, no worries, mate,everything's fine, but in
reality, yeah, you have aproblem.
So false negative can lead youdown the path of thinking
(12:16):
everything is all hunky-dory.
Question 11, which is the maindifference between a
vulnerability assessment and apenetration test?
We've talked about a lot aboutthis on CISSP Cyber Training.
So what's the differencebetween a vulnerability
assessment and a pen test?
A the vulnerability assessmentactively exploits weaknesses,
while the pen test onlyidentifies them.
B a vulnerability assessment isa continuous process, while pen
(12:40):
testing is a one-time event.
C a vulnerability assessmentfocuses on identifying
weaknesses, while the pen testattempts to exploit them to
demonstrate the overall impact.
Or D a vulnerability assessmentrequires specialized tools,
while pen tests can be donemanually.
And the answer is C Rightvulnerability assessments.
They focus on findingweaknesses and pen tests are
(13:01):
designed to exploit thoseweaknesses and to show I own the
castle, right.
The vulnerability assessmentshows, says to you oh yes, the
castle could be broken into.
The pen test says I'm justgoing to kick the door down and
walk right.
In Question 12, the securityteam is discussing various
approaches for testing a newapplication.
They decide to provide thetesters with some internal
(13:22):
knowledge of the application'sarchitecture and source code.
That's pretty interesting, butnot full access.
This approach is best describedas what?
A black box testing, b whitebox testing, c gray box testing.
Or D red team's assessments.
And the answer is C it's a graybox testing.
(13:42):
Basically, you're getting someelements from the black and
white box and it gives you alittle bit of insight into
what's actually going on.
It does allow you to getfurther into the organization
and it helps you kind of.
And it really is a good thingif you are on a tighter budget
and you want to be able just tosee what they can find, but you
want to not have them waste abunch of time trying to kick the
door the front door in.
(14:02):
So I would highly recommendgray box testing.
It's used, it.
It's a much more cost-efficientapproach.
But you just got to determinewhat are the needs for you and
your organization.
Question 13, which of thefollowing best describes the
purpose of a commonvulnerabilities and exposures
CVE system?
Again, what's the followingbest describes the purpose of a
common vulnerabilities andexposures system?
(14:25):
A to provide naming system forpublicly known cybersecurity
vulnerabilities and exposuressystem.
A to provide naming system forpublicly known cybersecurity
vulnerabilities and exposures.
B to provide a common languagefor describing security testing
procedures.
C to standards for scoring avulnerability severity.
Or.
D to define securityconfiguration checklists.
Again, which of the followingbest describes a purpose of a
common vulnerabilities and theCVE system?
(14:47):
And the answer is A to providea naming system for publicly
known cybersecurityvulnerabilities and exposures.
So it's basically a publiclydisclosed list that has
different vulnerabilities andthey have names.
To those, it provides uniqueidentifiers so you know which
one it is, and they then alsowork in coordination with the
various vulnerability managementteams to ensure that you are
(15:08):
properly being protected.
Question 14, when designing asecurity control testing
strategy, what is thesignificance of air quotes
perspective, more or lessinternal versus external testing
?
So, the perspective, what isthe benefit, the significance of
that?
A it determines the cost of thetesting engagement.
B it influences the tools andtechniques used during the test.
(15:30):
C, it dictates the reportingformat of the test results.
Or, d, it defines the scope andpotential impact of the
findings by simulating differentattacker vantage points.
Air quotes, perspective, right?
So again, what is designing asecurity control testing
strategy?
What is the significance ofperspective internal versus
external testing?
(15:50):
And the answer is D.
It defines the scope andpotential impact of the findings
by simulating different attackvantage points.
The ultimate point is just whatis it like if you get into the
environment from an internalperspective and what happens if
you're just trying to get bangon the door from the outside?
What are the different kind ofcontrol mechanisms and how are
they working depending upon yourperspective in the network?
(16:13):
Question 15, what is the primarypurpose of red team exercise in
a security control testing.
Again, what is the primarypurpose of a red team exercise
in security control testing?
A to validate the effectivenessof an incident response plan by
simulating realistic attacks.
B to perform automatedvulnerability scans on an
(16:33):
organization's network.
C to provide recommendationsfor security policy updates.
Or.
D to train the securityoperations center analysts on
new specific tools.
So what is the primary purposeof a red team?
It is A is to validate theeffectiveness of your incident
response plan and by simulatingpotentially real attacks, the
goal is, if you have a red teamthat you're banging on the door,
(16:55):
they want to see how does yourIR team respond to these banging
on the door.
It might just be a tap, so dothey hear you tapping?
And then you have to tap alittle louder and you tap a
little louder until eventuallythe IR team scrambles to their
feet and goes and addresses theissue.
Right, that's the purpose of ared team Now that and they also
are used for helping they do pentesting, and not necessarily
(17:17):
they may work a little bit withthe red or with your incident
response teams to do kind ofthey call it purple teaming,
where you would actually thenteach some of the folks while
they're trying to break in.
I highly recommend that.
It's a really good thing if youcan do it, but, that being said
, that's the purpose of a redteam.
Okay, so go to CISSP CyberTraining head over there.
Get some free content.
(17:38):
There's tons of stuff there.
There's also some stuff thatyou get.
I mean, honestly, it's a fairprice.
You go and you buy what I havethere on CISSP Cyber Training.
It is fair.
Getting your CISSP is expensive,but if you don't want to spend
the time to go to it or don'thave the money and don't want to
go to a boot camp, the CISSPCyber Trainings program is
(17:58):
amazing.
It will help you and yes, I ambiased, of course, because I
created it.
But, that being said, it willhelp you and it's the cheapest
amount of money that you willever spend to get your CISSP.
The only difference is you gotto do the work.
It's a self-study program.
Now we have also other tiersthat are available to do
mentorship and other ways that Ican help you, but bottom line
(18:20):
is that you can get all thetraining you need If you're
studying for the CISSP.
Go to CISSP Cyber Training andget access to it now.
All right.
I hope you all have a wonderful, wonderful day and we will
catch you all on the flip side,see ya.
Thanks so much for joining metoday on my podcast.
If you like what you heard,please leave a review on iTunes,
as I would greatly appreciateyour feedback.
Also, check out my videos thatare on YouTube and just head to
(18:42):
my channel at CISSP cybertraining and you will find a
plethora, or a cornucopia, ofcontent to help you pass the
CISSP exam the first time.
Lastly, head to CISSP CyberTraining and sign up for 360
free CISSP questions to help youin your CISSP journey.
Thanks again for listening.
Popular Podcasts
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.