Penetration Testing 3

Front 1

Nmap

Back 1

Network scanning tool- an open source Linux command-line used for network exploration, host discovery, and security auditing. Smaller scale internet tool.

Hint 1

* Defining Scope and Objectives

Front 2

Zmap

Back 2

Porter to a scanner. LARGE scale, speeds up the process

Front 3

Censys was created at the University of Michigan by the team of researchers who also develop what wide scale internet scaling tool?

Back 3

Zmap

Front 4

The best describe open source intelligence is

Back 4

Any information or data obtaining via Publicly available sources that is used to aid or drive decision- making processes

Hint 4

Open-source intelligence OSINT collection frameworks. Are used to effectively manage sources of collected information.

Front 5

Which method of collecting open source intelligent consists of the collection of published documents, such as Microsoft Office or PDF files, and parsing the information hidden within to reveal user names, email addresses, or sensitive data?

Back 5

Metadata analysis

Front 6

This search engine is not used by f o c a when searching for documents

Back 6

Yahoo

Hint 6

Bing, Google is used by FOCA

Front 7

What is the process by which large data sets are analyzed to reveal patterns or hidden anomalies?

Back 7

Data Mining

Front 8

What does CHD stand for?

Back 8

Cardholder data

Front 9

GDPR

Back 9

General Data Protection Regulation

Hint 9

It is a protection law implemented in May in 2018 to protect personal data

Front 10

SAD

Back 10

Sensitive Authentication Data

Hint 10

The most common SAD element is the card verification code/values(ie., CVC, CVV, CID), the 3 or 4 digits code on the front or back of the card

Front 11

NIST

Back 11

National Institute of Standards and Technology

Front 12

NIST 800-53

"Security In Privacy Controls for the Information Systems and Organizations"

Back 12

Offers a comprehensive set of security and privacy controls that organizations can use to safeguard their operations, assets, personnel, and other organizations from various threats in the risk

Front 13

Per NIST 800-53, in which control category does the media protection lie?

Back 13

Physical

Front 14

Per NIST 800-53, In which control category does the incident response lie?

Back 14

Administrative

Front 15

Which phase(name) NIST 800-53 compliance best practices results in correlating identify assets and permissions?

Back 15

Map phase

Front 16

Information Security Management and Compliance

Back 16

Protect information assets from unauthorized access, use, disclosure, interruptions alteration, and destruction

Front 17

Compliance

Back 17

Refers to observing information security- related legal, regulatory contractual, and industry-specific standards.

Front 18

Which ISO/IEC 2701 component Involve selecting and implementing controls to reduce the identified risk to an acceptable level?

Back 18

Risk Treatment

Front 19

In SOC 2 generic controls, Which control shows that the system remains available?

Back 19

Availability