Deliberately trying to find security weaknesses in your own system
Which of the following is a goal of penetration testing?
To identify possible entry points for an attack
A penetration tester is given a username, password and network diagram before testing a system. What type of penetration testing is this?
White box testing
A company wants to simulate an attack from an external hacker with no inside knowledge. Which type of penetration testing should they use?
Black box testing
What is ethical hacking?
Gaining access to a system with the owner's permission to find weaknesses
What distinguishes white hat hacking from black hat hacking?
White hat hacking is done with the owner's permission
After a penetration tester finds a security weakness, what should they do?
Report the findings to the organisation
What is meant by white box penetration testing?
Simulating an attack by an insider who has knowledge of the system
What is meant by black box penetration testing?
Simulating an attack from outside by someone with no inside knowledge
What is meant by black hat hacking?
Gaining unauthorised access to a computer system or its data
Which term describes a weakness in a computer system that an attacker could exploit?
Vulnerability
A user is tricked into revealing their password by an email that pretends to be from their bank. Which type of threat is this?
Social engineering
Why is it important for an organisation to protect data sent across its network?
To stop it being intercepted and read by attackers
During a penetration test, why might the tester try to break into the system?
To prove the weakness is real
Why might an organisation use both white box and black box penetration testing?
To test insider and external attacks
Which term describes an attack that floods a network with so much traffic that it cannot respond to genuine users?
Denial of service attack
Which term describes an attack that uses software to try many possible passwords until one is accepted?
Brute-force attack
Why do organisations usually keep the results of a penetration test confidential?
So that attackers cannot use the weaknesses found
A person breaks into a company's computer system without permission and demands payment to keep quiet about it. Which term describes this person?
Black hat hacker
What is the main purpose of a firewall on a network?
To filter packets between a trusted and an untrusted network
A network manager discovers a known malicious IP address is sending packets to the network. Which firewall feature should be used?
Blocking packets that are sent from that IP address
A software firewall is installed on a computer. What is a drawback of this compared with a dedicated hardware firewall?
It can slow down the computer it is installed on
Why do computer systems use usernames and passwords?
To prevent unauthorised people from using the system
Why do organisations give different members of staff different user access levels?
So each user can only open the files needed for their job
A password policy states that passwords must not be based on family names or dictionary words. Why is this?
These passwords are easier for attackers to guess
Which biometric method is more commonly used in high security environments?
Retinal scans
A data centre has a perimeter fence, security guards and an ID card entry system. Which risk do these measures mainly reduce?
Unauthorised people getting into the building
Which term describes hardware or software that separates a trusted network from an untrusted network and drops data that does not match its rules?
Firewall
What is meant by port blocking?
Stopping access to certain network ports by filtering the packets that use them
What is the name for the feature that checks where data travelling across a network has come from and where it is going, and drops anything that does not match a set of rules?
Packet filter
What is meant by access control?
Restricting who can use a system by using usernames, passwords and permissions
Which term describes the use of a person's physical characteristics, such as a fingerprint or a retinal scan, to verify their identity?
Biometric authentication
What is meant by physical security?
Protecting hardware, software and networks using physical methods such as locks and CCTV
A company wants to stop its staff from opening a list of unsuitable websites while they are at work. Which firewall feature makes this possible?
It can block traffic to certain websites
A network manager wants to stop staff using a program that connects to the network on one particular port. Which firewall feature should be used?
Port blocking
A company's password policy sets a minimum length and requires uppercase letters, lowercase letters and symbols in every password. Why does the policy do this?
It makes the password harder for an attacker to guess
A user unlocks a tablet simply by looking at it. Which method of access control is this?
Facial recognition
Which of these is an example of physical security?
Locks on doors and cabinets
A password policy requires staff to change their password every month. Why does this help to protect the network?
A discovered password can only be used for a short time
What happens to a packet that does not match a firewall's filtering rules?
It is dropped
A small company decides to use software firewalls instead of buying a dedicated hardware firewall. What is the most likely reason?