Review Questions

Now it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Assessments section at the end of the book:

1. Which pen tester would be given source code?
2. Why would a shared account pose a problem to monitoring?
3. Which pen tester would be given no access prior to the test but, at the last minute, is given a diagram of the desktops?
4. What needs to be established prior to a pen test commencing?
5. While carrying out an unannounced pen test, how does the tester know if the internal security team are on to him?
6. What is the scope of rules of engagement?
7. If the pen test has been announced to the IT team, what information should they give regarding the test prior to the test starting?
8. What is the main difference between a credentialed and a non-credentialed vulnerability scan?
9. At what phase of a pen test does the tester return the systems back to the original state or inform the IT...