Audits, Assessments, and Penetration Testing

Exam objective 5.5: Explain concepts associated with audit and assessment activities. This objective covers how an organization finds out whether its security program actually works. It begins with the ways auditors and assessors gather evidence (sampling, questionnaires and surveys, interviews, assertions, and reference sources such as MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis). It then covers how an engagement is scoped through an audit charter and a defined frequency, the different engagement types (gap analysis, internal and external engagements, and benchmarking), penetration testing in all its forms, the industry, international, and regional frameworks that define what "good" looks like, and the difference between functional testing and behavioral testing.

This is an "explain" objective. You will not be asked to run an exploit or write an audit report, but you must be able to read a short description and identify what kind of activity is happening: Is this an internal self-assessment or an independent third-party audit? Is the tester working in a known or unknown environment? Is the team doing passive or active reconnaissance? Is this a red, blue, or purple team exercise? Most questions in this area are vocabulary-in-context, so focus on the distinguishing feature of each term.

Why Audits and Assessments Matter

Writing a policy, buying a firewall, or rolling out MFA does not prove that risk has been reduced. Controls drift, configurations change, people take shortcuts, and attackers find paths that designers never imagined. Audits and assessments close the loop between what an organization says it does and what it actually does. They produce evidence for executives and boards, satisfy regulators and customers, and feed the risk management process described in Chapter 23.

It helps to keep three related terms distinct:

Term Primary question Typical output Who usually performs it

Audit Does the organization comply with a defined standard, policy, or contract?

Formal opinion or report with

findings against criteria

Internal audit function or independent external auditor

Assessme

nt

How well are controls designed and operating, and where are the weaknesses?

Risk-ranked findings and recommendations

Internal security staff, consultants, or third parties

Penetratio

n test

Can a skilled adversary actually exploit weaknesses to reach an objective?

Narrative of attack paths, exploited vulnerabilities, and remediation advice

Authorized internal red team or external testing firm

An audit is measured against criteria (a regulation, contract, framework, or internal policy). An assessment is broader and more advisory. A penetration test is the most adversarial: it demonstrates impact by exploiting weaknesses within agreed rules of engagement.

Note

Audits and assessments connect to many other chapters. Policies and standards that serve as audit criteria are covered in Chapter 22, risk analysis in Chapter 23, vendor assessments and right-to-audit clauses in Chapter 24, compliance monitoring and attestation in Chapter 25, and vulnerability scanning and pen test report review in Chapter 16.

Data Gathering

Every audit or assessment depends on evidence. Auditors cannot examine every transaction, read every log, or interview every employee, so they use a set of data-gathering techniques that balance thoroughness against time and cost. The quality of the conclusion depends directly on the quality of the evidence.

Sampling

Sampling is examining a subset of a population to draw conclusions about the whole. If an organization processed 12,000 access requests last year, an auditor might select 60 of them and verify that each had a documented approval from the data owner. If all 60 are compliant, the auditor gains reasonable (not absolute) assurance that the process works.

Sampling can be random (statistical), giving every item an equal chance of selection and resisting bias; judgmental (targeted), deliberately selecting high-risk items such as privileged accounts or emergency changes; systematic, selecting every nth item; or stratified, sampling each department or region so none is overlooked. The key risk is sampling risk: the sample may not be representative, leading to a wrong conclusion. Automation increasingly allows 100 percent testing of some controls, such as comparing every active directory account against the HR termination list.

Questionnaires and Surveys

Questionnaires and surveys gather information from many people or organizations efficiently. Security teams use them to collect control information from business units, and third-party risk programs send standardized questionnaires to vendors (Chapter 24). Industry-standard questionnaires such as the Shared Assessments SIG (Standardized Information Gathering) questionnaire or the Cloud Security Alliance CAIQ (Consensus Assessments Initiative Questionnaire) let vendors answer once and share with many customers.

Questionnaires scale well, but answers are self-reported and may be wrong or optimistic. Good assessors treat them as leads to verify with documents, configuration exports, or testing.

Interviews

Interviews are structured conversations with the people who own, operate, or depend on a control. An auditor might interview the backup administrator to understand how restoration tests are performed, or a help desk lead to understand how identities are verified before a password reset. Interviews reveal how processes really work, uncover undocumented workarounds, and provide context that documents lack.

Interviews are subjective—people describe processes as they are supposed to work—so skilled interviewers ask open-ended questions ("Walk me through the last time you onboarded a contractor") and corroborate answers with evidence.

Assertion

An assertion is a formal claim by management that something is true—for example, "All production systems are patched within 30 days of a critical patch release" or "Access to cardholder data is restricted to authorized personnel." In audit practice, management makes assertions and the auditor gathers evidence to test them. Many attestation engagements are built entirely around management's assertions: the auditor's report states whether management's description of its controls is fairly presented and whether the controls operated effectively.

Assertions matter because they create accountability. When a CEO or CISO signs an assertion, management takes responsibility for its accuracy, and a false assertion can carry legal and regulatory consequences. Assertions connect directly to the attestation and acknowledgement concepts in Chapter

Exam tip

The evidence hierarchy matters. Evidence the auditor obtains directly (observing a process, re-performing a control, pulling a configuration) is stronger than evidence provided by the auditee (a screenshot), which is stronger than a verbal statement in an interview or a self-reported questionnaire answer. A management assertion is a claim to be tested, not evidence that a control works.

Reference Sources

Assessors and penetration testers use reference models to organize what they gather, describe adversary behavior consistently, and identify gaps in detection and prevention. The SY0-801 objectives name three.

Mitre att&ck

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base of adversary behavior based on real-world observations. It is organized as a matrix:

• Tactics are the adversary's goals—the "why" (for example, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact).
• Techniques and sub-techniques are the "how" (for example, T1566 Phishing, with sub-technique T1566.001 Spearphishing Attachment).
• Procedures are specific implementations observed in use by particular threat groups. Separate matrices cover Enterprise, Mobile, and ICS. Assessors use ATT&CK to map existing detections and identify coverage gaps ("we detect credential dumping but not Kerberoasting"), to plan red and purple team exercises that emulate a specific threat group, and to describe findings in a common language.

Cyber Kill Chain

The Cyber Kill Chain, developed by Lockheed Martin, models an intrusion as seven sequential phases: Phase What the attacker does Example defensive opportunity

Reconnaissance

Researches the target, harvests email addresses, scans for exposed services

Limit public information, monitor for scanning

Weaponization

Couples an exploit with a payload (for example, a malicious document)

Threat intelligence on attacker tooling

• 3. Delivery Transmits the weapon (email, web, USB) Email filtering, web gateways, user awareness
• 4. Exploitation Triggers the vulnerability to execute code Patching, exploit protection, EDR
• 5. Installation Installs malware or a backdoor for persistence Application allow listing, EDR
• 6. Command and Control (C2)

Establishes a channel to control the compromised host DNS filtering, egress filtering, network monitoring

• 7. Actions on Objectives

Steals data, encrypts files, or disrupts operations DLP, segmentation, backups The core insight is that breaking any link stops the attack, and that detecting an attacker early in the chain is far cheaper than detecting them at the end. The model's weakness is that it is linear and perimeter-focused; it describes insider threats and cloud-native attacks less well than ATT&CK does.

Diamond Model of Intrusion Analysis

The Diamond Model describes every intrusion event in terms of four core features arranged at the corners of a diamond:

• Adversary — the actor or group responsible.
• Capability — the tools, malware, and techniques used.
• Infrastructure — the IP addresses, domains, servers, and accounts used to deliver capability and maintain control.
• Victim — the targeted person, organization, or asset.

Each feature is connected to the others, so an analyst who knows one or two corners can pivot to discover the rest. For example, a malware sample (capability) contacts a domain (infrastructure); other samples that use the same domain may reveal additional victims or attribute the activity to a known adversary.

Figure 26.1: The Diamond Model links adversary, capability, infrastructure, and victim so analysts can pivot from one known feature to the others

Memory aid

Three models, three questions. ATT&CK answers "What exactly did they do?" (a detailed catalog of tactics and techniques). Kill Chain answers "How far did they get?" (seven sequential phases). Diamond answers "How are the pieces related?" (adversary, capability, infrastructure, victim). If a question mentions pivoting between infrastructure and victims, think Diamond; if it mentions phases from reconnaissance to actions on objectives, think Kill Chain; if it mentions tactics, techniques, and procedures or a matrix, think ATT&CK.

Scoping

An audit without a clear scope wastes effort and invites disputes about what was and was not examined. Scoping defines the authority, objectives, boundaries, and timing of the work.

Audit Charter

An audit charter is a formal document, approved by the board or audit committee, that establishes the internal audit function's purpose, authority, and responsibility. It grants auditors access to the records, personnel, systems, and locations they need; establishes independence by having internal audit report functionally to the audit committee rather than to the managers being audited; names the professional standards followed; and defines how findings are reported and tracked. For individual engagements, an engagement letter or scoping document defines the specific systems, period under review, criteria, and deliverables.

Frequency

Frequency determines how often audits and assessments occur. It is driven by regulatory and contractual requirements (PCI DSS, for example, requires quarterly vulnerability scans and annual penetration tests, plus testing after significant changes), by risk (high-risk systems are reviewed more often), by change (a merger, cloud migration, or major release triggers new assessments), and by prior findings that need follow-up. Frequency options range from one-time (point-in-time) engagements, to periodic (annual, quarterly), to continuous monitoring through automated tools. A point-in-time audit only shows what was true on the day evidence was gathered; continuous approaches reduce the window in which a control can silently fail.

Common trap

A clean point-in-time audit does not guarantee the control is working today. If a question asks how to maintain assurance between annual audits, look for continuous monitoring, automated compliance checks, or more frequent internal self-assessments.

Engagement Types

The objectives group engagements into gap analysis, internal engagements, external engagements, and benchmarking. The distinguishing features are who performs the work, who receives the results, and what the results are compared against.

Gap Analysis

A gap analysis compares the current state of security controls against a desired target state—usually a framework, standard, or regulation—and identifies the differences (gaps). For example, an organization preparing for ISO/IEC 27001 certification compares its existing controls against the standard's requirements and Annex A controls, then builds a roadmap to close each gap before the certification audit.

A gap analysis is typically a preparatory activity. It does not result in certification or a formal opinion; it produces a prioritized list of work. (Chapter 1 introduced gap analysis in the context of control selection.)

Internal Engagements

Internal engagements are performed by people within the organization—the internal audit department, the security team, or the business units themselves.

• Compliance reviews check whether the organization is following its own policies and applicable external requirements. For example, a quarterly check that all new hires completed training and signed the AUP.
• Audit committee oversight is provided by a committee of the board of directors (typically independent, non-executive directors) that oversees internal controls, risk, and both internal and external auditors. It approves the audit charter and plan and receives audit reports directly, so internal audit can report problems without fear of retaliation by the managers being audited.
• Self-assessments are performed by the owners of a process or system on their own controls. They are inexpensive and build ownership but lack independence; people rate their own controls generously.

External Engagements

External engagements are performed by parties outside the organization. They carry more weight with regulators, customers, and investors because of their independence.

• Examinations are formal reviews conducted by regulators or examiners with legal authority—for example, banking regulators examining a financial institution's information security program.
• Assessments by external parties evaluate controls and risk against a framework; a PCI DSS assessment by a Qualified Security Assessor (QSA) resulting in a Report on Compliance (ROC) is a classic example.
• Regulatory audits are required or performed by government agencies to verify compliance with laws and regulations—for example, a health regulator investigating HIPAA compliance or a data protection authority auditing GDPR processing practices. Failing a regulatory audit can lead to fines, sanctions, or loss of license (Chapter 25).
• Independent third-party audits are performed by an independent auditing firm with no stake in the outcome. Examples include SOC 2 Type II reports (issued by CPA firms under AICPA standards) and ISO/IEC 27001 certification audits performed by accredited certification bodies. Customers often accept these reports in place of their own audits.

• Engagement Performed by Independe
• nce
• Typical purpose
• Self-assessment Control owners Low Ongoing improvement, readiness

Internal compliance review Internal compliance or audit staff

Moderate Verify adherence to policy and regulation

Internal audit (reporting to audit committee)

Internal audit department

Moderate to high

Objective assurance to the board

External assessment Consultants or assessors High Evaluate controls against a framework Regulatory audit or examination

Government regulator High, with legal authority

Enforce legal compliance

Independent third-party audit Accredited audit firm Highest Certification or attestation for customers and partners

Note

SOC reports come up often in vendor discussions. A SOC 1 report addresses controls relevant to customers' financial reporting. A SOC 2 report addresses the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy). A Type I report evaluates control design at a point in time; a Type II report evaluates operating effectiveness over a period (often 6 to 12 months). A SOC 3 is a general-use summary of a SOC 2 suitable for public distribution.

Benchmarking

Benchmarking compares an organization's security posture, practices, or metrics against peers, industry averages, or recognized best-practice baselines. Examples include comparing patch latency, phishing click rates, or security spending against peer averages, or measuring configurations against CIS Benchmarks.

Gap analysis and benchmarking are easily confused. A gap analysis compares you against a standard (what you should do). Benchmarking compares you against others or a published reference baseline (how you measure up). Both identify improvement opportunities; neither produces a formal audit opinion.

Exam tip

Watch the distinguishing words. "Measure against the requirements of ISO 27001 before the certification audit" is gap analysis. "Compare our mean time to patch against similar organizations in our sector" is benchmarking. "The board's committee that oversees auditors" is the audit committee. "A CPA firm issues a SOC 2 Type II report" is an independent third-party audit.

Penetration Testing

A penetration test (pen test) is an authorized, simulated attack against systems, applications, networks, people, or facilities to identify and exploit weaknesses and demonstrate real-world impact. Unlike a vulnerability scan, which identifies potential weaknesses (Chapter 16), a pen test attempts to exploit them, chain them together, and show what an attacker could achieve.

Rules of Engagement and Authorization

No pen test should begin without written authorization. The rules of engagement (RoE) (also covered in Chapter 24) define the scope (in-scope and excluded IP ranges, applications, buildings, and people), timing and blackout windows, permitted techniques (social engineering, denial of service, physical intrusion), data handling, communication and escalation paths for critical findings or outages, and legal protection in the form of a signed authorization letter that a physical tester can show if detained. When testing cloud services or third-party hosted systems, the tester also needs permission from the provider or must follow the provider's published testing policy, because the client does not own the underlying infrastructure.

Testing Environments: Known, Unknown, and Partially Known

The amount of information the tester receives before starting defines the testing environment. CompTIA uses the neutral terms below; you will also see the older color terms.

Environm

ent

Older term

What the tester knows Simulates Pros and cons

Known environme

nt

White box (clear box)

Full details: network diagrams, source code, credentials, architecture

An insider or a thorough audit

Most thorough coverage per hour; less realistic about external

discovery

Partially known environme

nt

Gray box Some information, such as a user-level account or a list of in-scope IPs

An attacker with some foothold, or a malicious insider with limited access

Balances realism and efficiency; the most common approach

Unknown environme

nt

Black box Nothing beyond the target name

An external attacker with no inside knowledge

Most realistic; time spent on discovery may leave less time for deep testing

Exam tip

Match the scenario to the knowledge level. "The tester was given only the company name" is unknown environment. "The tester received network diagrams and application source code" is known environment. "The tester received a standard employee account" is partially known environment.

Physical Penetration Testing

A physical penetration test evaluates the controls that protect facilities: fences, locks, badges, guards, access vestibules, cameras, alarms, and the people who staff them. Testers may attempt to tailgate behind employees, clone badges with RFID readers, pick or bypass locks, pose as delivery or maintenance personnel, plant rogue devices on the internal network, or search for sensitive documents in trash (dumpster diving).

Physical testing often overlaps with social engineering because people are usually the weakest point of physical security. Because testers may be confronted by guards or police, the RoE must specify what to do if challenged, and testers carry signed authorization with an after-hours contact number.

Real-world scenario

A healthcare company hires a firm to test its new data center. The rules of engagement allow physical and social engineering techniques but prohibit damaging property. A tester wearing a high-visibility vest and carrying a ladder follows an employee through a badge-controlled door, then plugs a small network implant into a conference room port. Within an hour, the implant is beaconing to the testing firm's server. The final report recommends access vestibules for sensitive areas, employee training on challenging unbadged visitors, and 802.1X port authentication so that unknown devices cannot join the network. The test demonstrated a chain of physical, human, and technical weaknesses that no vulnerability scan could have found.

Offensive, Defensive, and Integrated Testing

The objectives describe three testing postures that correspond to the familiar team colors:

• Offensive testing is performed by a red team that emulates real adversaries. A red team engagement is goal-oriented ("obtain the CFO's mailbox" or "reach the payment database") and often stealthy, testing not just vulnerabilities but whether defenders detect and respond. Red teams often use ATT&CK to emulate the tactics and techniques of a specific threat group.
• Defensive testing is performed by a blue team—the security operations staff who monitor, detect, respond, and harden. In an exercise, the blue team's detection and response capabilities are what is being tested, and it may be evaluated on how quickly it identifies and contains the red team's activity.
• Integrated testing combines offensive and defensive teams working together—the purple team approach. Instead of the red team operating secretly and handing over a report weeks later, red and blue collaborate in real time: the red team executes a technique, the blue team checks whether it was detected, and together they tune detections and controls. The goal is to maximize learning and improve defenses quickly.

Figure 26.2: Separate red and blue exercises deliver lessons afterward, while purple teaming improves detections in a real-time loop

Memory aid

Red attacks, blue defends, purple is red plus blue working together. Offensive = red, defensive = blue, integrated = purple.

Reconnaissance: Passive and Active

Reconnaissance is the information-gathering phase that precedes exploitation, and it mirrors the first phase of the Cyber Kill Chain.

Passive reconnaissance gathers information without directly interacting with the target's systems, so the target cannot easily detect it. Techniques include open-source intelligence (OSINT) from websites, job postings, and employee social media; WHOIS and DNS lookups through public resolvers; certificate transparency logs that reveal subdomains; search engine queries; internet-wide scan databases that have already indexed exposed services; and breach data containing leaked credentials. Active reconnaissance directly interacts with the target and can be detected by IDS, firewalls, and logs. Techniques include port scanning and service enumeration, vulnerability scanning, banner grabbing, network mapping, and pretext calls that directly engage employees.

• # Passive: no packets reach the target's servers
• whois example.com
• dig example.com MX @8.8.8.8

# Active: probes go directly to the target and may be logged or blocked nmap -sS -sV -p 1-1024 203.0.113.0/24

Figure 26.3: Passive reconnaissance queries public and third-party sources, while active reconnaissance sends traffic to systems the target owns

Common trap

Querying public DNS records is generally considered passive because the tester interacts with public resolvers rather than the target's systems; however, attempting a zone transfer directly against the target's authoritative name server is active. On the exam, the test is simple: did the tester send traffic to systems the target owns or operates? If yes, it is active.

Note

Bug bounty programs (Chapter 16) are a related but different approach: the organization invites outside researchers to find and responsibly report vulnerabilities in exchange for rewards. A bug bounty offers continuous, crowd-sourced coverage but less control over methodology; a pen test offers a defined scope, timeline, and report.

Frameworks and Standards

Audits and assessments need criteria—an agreed definition of what good security looks like. The objectives group frameworks and standards into three kinds.

Industry-Based

Industry-based frameworks apply to organizations in a particular sector or that perform a particular activity, regardless of location. PCI DSS applies to any organization that stores, processes, or transmits cardholder data; it is a contractual requirement enforced by the card brands, not a law. NERC CIP applies to the North American bulk electric system, HITRUST CSF is a certifiable framework common in healthcare, and the HIPAA Security Rule applies to U.S. healthcare entities and their business associates (it is both industry-based and region-specific).

International

International frameworks come from global standards bodies and are used across countries and industries. ISO/IEC 27001 specifies requirements for an information security management system (ISMS) and is certifiable through accredited third-party audits; ISO/IEC 27002 gives control implementation guidance, ISO/IEC 27701 extends the ISMS to privacy, and ISO 31000 covers risk management. The CIS Critical Security Controls and CIS Benchmarks are used worldwide, as is the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), even though a U.S. agency publishes it.

Region-Specific

Region-specific frameworks and regulations apply within a particular country, state, or economic area: GDPR for personal data of individuals in the EU, the NIS2 Directive for essential and important entities in the EU, DORA for operational resilience of EU financial entities, CCPA/CPRA for California consumers, PIPEDA for Canadian private-sector personal information, and FedRAMP for cloud services used by U.S. federal agencies.

Category Defining feature Examples

Industry-basedApplies because of what you do or what data you handle PCI DSS, NERC CIP, HITRUST, HIPAA International Global standards body; applies across borders and sectors ISO/IEC 27001, 27002, 27701, CIS Controls

Region-specificApplies because of where you operate or whose data you process

Gdpr, nis2, dora, ccpa/cpra,

FedRAMP, PIPEDA

Organizations often must satisfy several at once. A European online retailer that accepts cards is subject to PCI DSS (industry), GDPR (region), and may pursue ISO 27001 certification (international) to demonstrate its program to business customers. Control mapping—identifying where one control satisfies requirements in several frameworks—reduces duplicate effort and audit fatigue. If a question asks which framework applies to a company because it accepts credit cards, choose PCI DSS (industry-based). If it asks about a company that handles personal data of EU residents, choose GDPR (region-specific). If it asks for an internationally recognized, certifiable ISMS standard, choose ISO/IEC 27001.

Functional Testing

Functional testing verifies that a control, system, or feature performs its intended function correctly— that it does what it is supposed to do. In an audit context, this is often called control testing or testing of operating effectiveness, and it goes beyond reviewing documentation to actually exercise the control. Examples include attempting to log in with an expired password to confirm the policy is enforced, sending a test file of dummy card numbers to confirm DLP blocks it, restoring a backup to confirm data is recoverable within the RTO (Chapter 13), and disabling a test user in the HR system to confirm automatic deprovisioning in connected applications.

Auditors distinguish between design effectiveness (would the control, as designed, address the risk?) and operating effectiveness (did the control actually work consistently throughout the period?). Functional testing provides evidence of operating effectiveness. A common technique is re-performance, in which the auditor independently executes the control and compares results. In software and system development, functional testing confirms that security features meet requirements—for example, that a role without the "approve payments" permission cannot reach the approval API. Functional testing answers the question "Does it work?"

Behavioral Testing

Behavioral testing evaluates how people and systems actually behave under realistic conditions, rather than whether a control exists or functions in isolation. It answers the question "What happens in practice?"

For people, behavioral testing measures whether employees follow security policy when confronted with real-world situations:

• Phishing simulations measure who clicks, who enters credentials, and—most importantly—who reports the message (Chapter 27).
• Vishing and pretexting tests check whether help desk staff follow identity verification procedures before resetting passwords.
• Physical tests check whether employees challenge tailgaters or leave sensitive documents on desks and printers.
• USB drop tests check whether employees plug in found removable media.

For systems and applications, behavioral testing observes runtime activity under realistic or adversarial conditions—running a suspicious file in a sandbox and recording its processes, file changes, and network connections, or fuzzing an application with malformed input. It also checks whether behavior-based tools such as EDR actually alert when realistic attack techniques are executed, often through ATT&CK-based adversary emulation. Aspect Functional testing Behavioral testing

Core question

Does the control do what it was designed to do?

How do people and systems actually act in realistic conditions?

Focus Specific features, controls, and requirements Human decisions, runtime activity, responses to adversarial input

Typical method

Test cases, re-performance, configuration checks

Simulations, observation, sandboxing, adversary emulation

Example Confirm the account locks after five failed logins

Measure how many staff report a simulated phishing email

Result type Pass/fail against expected outcome Rates, trends, and observed patterns

Real-world scenario

An audit of a bank's wire transfer process finds that the dual-approval control works correctly: a test wire submitted by one user cannot be released until a second user approves it (functional testing passed). A behavioral test the following month tells a different story. A tester calls the payments team posing as an executive traveling abroad and urgently requests a wire. The first approver initiates it, and the second approver, seeing the executive's name, approves without calling back on a known number. The control functioned exactly as designed, yet the process failed because people did not behave as the policy assumed. The remediation is targeted training and a mandatory call-back procedure, not a technical fix.

Chapter Summary

• Audits measure compliance against defined criteria, assessments evaluate control design and effectiveness more broadly, and penetration tests demonstrate exploitability and impact.
• Data gathering techniques include sampling (random, judgmental, systematic, stratified), questionnaires and surveys, interviews, and testing management assertions. Direct evidence is stronger than self-reported evidence.
• MITRE ATT&CK catalogs adversary tactics and techniques; the Cyber Kill Chain describes seven sequential intrusion phases; the Diamond Model relates adversary, capability, infrastructure, and victim.
• Scoping is established by an audit charter (authority, independence, reporting to the audit committee) and by a frequency driven by regulation, risk, change, and prior findings.
• Gap analysis compares current state to a target standard. Internal engagements include compliance reviews, audit committee oversight, and self-assessments. External engagements include examinations, assessments, regulatory audits, and independent third-party audits. Benchmarking compares against peers or reference baselines.
• Penetration tests require written authorization and rules of engagement. Environments are known (full information), partially known (some information), or unknown (no information). Physical tests target facilities and people. Offensive (red), defensive (blue), and integrated (purple) teams test from different perspectives.
• Passive reconnaissance does not touch target systems; active reconnaissance does and can be detected.
• Frameworks and standards are industry-based (PCI DSS, NERC CIP), international (ISO/IEC 27001, CIS Controls), or region-specific (GDPR, NIS2, CCPA).
• Functional testing confirms a control performs as designed; behavioral testing observes how people and systems actually act in realistic situations.

Key Terms

Audit; assessment; penetration test; sampling; sampling risk; judgmental sampling; questionnaire; survey; interview; assertion; MITRE ATT&CK; tactics, techniques, and procedures (TTPs); Cyber Kill Chain; Diamond Model of Intrusion Analysis; adversary; capability; infrastructure; victim; scoping; audit charter; independence; frequency; point-in-time assessment; continuous monitoring; gap analysis; internal audit; compliance review; audit committee; self-assessment; external audit; examination; regulatory audit; independent third-party audit; SOC 2 Type II; benchmarking; rules of engagement; known environment; partially known environment; unknown environment; physical penetration test; offensive testing; red team; defensive testing; blue team; integrated testing; purple team; passive reconnaissance; active reconnaissance; OSINT; bug bounty; industry-based framework; international standard; region-specific regulation; PCI DSS; ISO/IEC 27001; GDPR; functional testing; operating effectiveness; re-performance; behavioral testing; phishing simulation.

Review Questions

• 1. An auditor reviewing user access selects all 40 accounts with domain administrator privileges plus 25 standard accounts created outside business hours, rather than choosing accounts at random. Which data-gathering technique is the auditor using?

• A. Random sampling
• B. Judgmental sampling
• C. Questionnaire
• D. Assertion

• 2. A penetration tester is given only the company's name and primary domain and told to find a way into the internal network. Which type of testing environment does this describe?

• A. Known environment
• B. Partially known environment
• C. Unknown environment
• D. Integrated environment

• 3. A threat intelligence analyst discovers that a malware sample communicates with a specific domain. By researching that domain, the analyst finds other malware samples and identifies two additional organizations that were targeted by the same group. Which reference model BEST describes this analytic approach?

• A. Cyber Kill Chain
• B. Diamond Model of Intrusion Analysis
• C. MITRE ATT&CK
• D. NIST CSF

• 4. Which of the following are examples of passive reconnaissance? (Select TWO.)

• A. Running a port scan against the target's public IP range
• B. Reviewing the target's job postings for technologies in use
• C. Grabbing service banners from the target's web servers
• D. Searching certificate transparency logs for the target's subdomains
• E. Calling the help desk while posing as an employee

• 5. A company's security operations team and an internal attack team work side by side during a two-week exercise. After each attack technique is executed, both teams review whether alerts fired and immediately tune detection rules. Which type of testing does this describe?

• A. Offensive
• B. Defensive
• C. Integrated
• D. Physical

• 6. A software-as-a-service provider wants to give prospective customers independent assurance that its security controls operated effectively over the past year, without allowing each customer to audit it individually. Which of the following BEST meets this need?

• A. A self-assessment questionnaire completed by the provider's security team
• B. A gap analysis against ISO/IEC 27001
• C. A SOC 2 Type II report from an independent audit firm
• D. A benchmarking study comparing the provider to its competitors

• 7. Which document establishes the internal audit function's authority to access systems and records and defines its reporting line to the board?

• A. Rules of engagement
• B. Audit charter
• C. Statement of work
• D. Service-level agreement

• 8. A company that is not yet certified wants to determine what work is required before an ISO/IEC 27001 certification audit. Which engagement type should it perform FIRST?

• A. Regulatory examination
• B. Benchmarking
• C. Gap analysis
• D. Penetration test

• 9. An auditor confirms that a firewall change request system rejects any change that lacks CAB approval by submitting a test change without approval and observing that it is blocked. Which type of testing is this?

• A. Behavioral testing
• B. Functional testing
• C. Passive reconnaissance
• D. Benchmarking

• 10. A retailer headquartered in Germany sells online to consumers across the EU and accepts credit card payments. Which of the following frameworks or regulations apply to it? (Select TWO.)

• A. NERC CIP
• B. PCI DSS
• C. FedRAMP
• D. GDPR
• E. HIPAA

• 11. During an approved engagement, a tester dressed as an HVAC technician follows employees into a secure office area and photographs whiteboards in an engineering lab. Which type of assessment is being performed?

• A. Physical penetration test
• B. Vulnerability scan
• C. Self-assessment
• D. Functional test

• 12. After a series of training sessions, a security manager wants to know whether employees now follow the policy of verifying callers before discussing account details. Which approach would BEST measure this?

• A. Ask department managers to complete a survey about their teams' compliance
• B. Obtain a signed assertion from each employee confirming they follow the policy
• C. Conduct unannounced pretext calls and record how staff respond
• D. Review the training completion records in the LMS

Answers and Explanations

• 1. B. Deliberately choosing high-risk items such as privileged accounts and accounts created at unusual times is judgmental (targeted) sampling. Random sampling would give every account an equal chance of selection. A questionnaire collects self-reported answers, and an assertion is a claim made by management, not a selection technique.
• 2. C. With no information beyond the company name and domain, the tester is working in an unknown environment (formerly black box), simulating an external attacker. A known environment would include diagrams, source code, or credentials; a partially known environment would include some insider information such as a user account. "Integrated" describes a purple team posture, not an information level.
• 3. B. The Diamond Model relates adversary, capability, infrastructure, and victim, and its strength is pivoting from one feature to discover others—here from capability (malware) to infrastructure (domain) to additional victims. The Kill Chain describes sequential phases, ATT&CK catalogs techniques, and NIST CSF is a program framework, not an intrusion analysis model.
• 4. B, D. Job postings and certificate transparency logs are public sources that do not require sending any traffic to the target's systems, so they are passive. Port scanning and banner grabbing interact directly with target hosts and are active. Calling the help desk directly engages the target's people and is active social engineering.
• 5. C. Red (offensive) and blue (defensive) teams collaborating in real time to improve detections is integrated testing, commonly called purple teaming. Offensive testing alone would be a red team operating against unaware defenders; defensive testing focuses on the blue team's monitoring and response; physical testing targets facilities.
• 6. C. A SOC 2 Type II report is an independent third-party attestation covering operating effectiveness over a period, and customers commonly accept it in lieu of their own audits. A self-assessment lacks independence. A gap analysis is preparatory and produces no formal opinion. Benchmarking compares against peers and does not provide assurance about specific controls.
• 7. B. The audit charter, approved by the board or audit committee, grants internal audit its authority, defines its scope, and establishes independence through its reporting line. Rules of engagement govern a specific test. A statement of work defines deliverables in a contract, and an SLA defines service performance levels.
• 8. C. A gap analysis compares current controls against the requirements of the target standard and identifies what must be done before certification. A regulatory examination is performed by a government authority. Benchmarking compares against peers. A penetration test evaluates exploitability but does not map the organization against ISO requirements.
• 9. B. Exercising a control to confirm it performs as designed is functional testing (testing operating effectiveness through re-performance). Behavioral testing would observe how people act in realistic situations. Passive reconnaissance is information gathering, and benchmarking compares against peers.
• 10. B, D. Accepting credit cards brings the retailer under PCI DSS, an industry-based standard, and processing EU residents' personal data brings it under GDPR, a region-specific regulation. NERC CIP applies to the North American electric sector, FedRAMP applies to cloud services used by U.S. federal agencies, and HIPAA applies to U.S. healthcare entities.
• 11. A. Gaining entry to facilities through tailgating and impersonation is physical penetration testing (combined with social engineering). A vulnerability scan is a technical, automated activity. A self-assessment is performed by control owners on their own controls, and functional testing exercises a specific control to confirm it works.
• 12. C. Unannounced pretext calls directly observe employee behavior under realistic conditions, which is behavioral testing and the most reliable measure. Manager surveys and employee assertions are self-603 reported and tend to overstate compliance. LMS records show that training was completed, not that behavior changed.