In which of the following testing methodologies do assessors use all available documentation and
work under no constraints, and attempt to circumvent the security features of an information
system?
A.
Full operational test
B.
Penetration test
C.
Paper test
D.
Walk-through test
Explanation:
A penetration testing is a method of evaluating the security of a computer system or
network by simulating an attack from a malicious source. The process involves an active analysis
of the system for any potential vulnerabilities that may result from poor or improper system
configuration, known or unknown hardware or software flaws, or operational weaknesses in
process or technical countermeasures. This analysis is carried out from the position of a potential
attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are
found will be presented to the system owner together with an assessment of their impact and often
with a proposal for mitigation or a technical solution. The intent of a penetration test is to
determine feasibility of an attack and the amount of business impact of a successful exploit, if
least complex test in the disaster recovery and business continuity testing approaches. In this test,
the BCP/DRP plan documents are distributed to the appropriate managers and BCP/DRP team
members for review, markup, and comment. This approach helps the auditor to ensure that the
plan is complete and that all team members are familiar with their responsibilities within the plan.
continuity and disaster recovery process. In this testing methodology, appropriate managers and
BCP/DRP team members discuss and walk through procedures of the plan. They also discuss the
test includes all team members and participants in the disaster recovery and business continuity
process. This full operation test involves the mobilization of personnel. It restores operations in the
same manner as an outage or disaster would. The full operational test extends the preparedness
test by including actual notification, mobilization of resources, processing of data, and utilization of
backup media for restoration.