Review Questions

Now, it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. Which pen tester would be given source code?
2. Why would a shared account pose a problem to monitoring?
3. Which pen tester would be given no access before the test but, at the last minute, is given a diagram of the desktops?
4. What needs to be established prior to a pen test commencing?
5. While carrying out an unannounced pen test, how does the tester know if the internal security team is on to him?
6. What is the scope of rules of engagement?
7. If the pen test has been announced to the IT team, what information should they give regarding the test before the test start?
8. What is the main difference between a credentialed and a non-credentialed vulnerability scan?
9. At what phase of a pen test does the tester return the systems to the original state or inform the IT team of vulnerabilities...