Introduction

This chapter covers the fifth objective of Domain 5.0, Security Program Management and Oversight of the CompTIA Security+ exam.

In this chapter, we look at the world of audits, a critical component of organizational governance and accountability, considering the importance of attestation on both counts. Audits serve as essential tools for assessing compliance by evaluating the effectiveness of internal controls and identifying areas for improvement within an organization. This chapter focuses on both internal and external audits and the benefits of each and ends with an exploration of penetration testing, including passive and active reconnaissance.

This chapter will give you an overview of why companies rely on these processes to keep their environments safe to ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 5.5 will be provided at the end of the chapter...

Summary

This chapter provided valuable insights into the world of audits and attestation, highlighting their essential roles in promoting transparency, compliance, and security within organizations, beginning with a summary of attestation and its significance as a rigorous process that underpins trust and accountability.

This exploration began with internal audits—a vital component of an organization’s governance framework that serves essential purposes such as risk management, compliance assessment, and self-improvement through self-assessments—followed by external audits, which play a pivotal role in financial oversight, governance, and accountability, encompassing regulatory compliance audits, detailed examinations, and assessments that help maintain transparency and ensure adherence to industry standards.

Finally, you examined distinct types of penetration testing, including offensive, defensive, and integrated approaches, including their unique purposes...

Exam Objectives 5.5

Explain types and purposes of audits and assessments.

• Attestation: External validation of information
• Internal audits: Audits within an organization
  • Compliance: Adherence to rules and regulations
  • Audit committee: Oversight of internal audit functions
  • Self-assessments: Internal evaluations for improvement
• External audits: Audits by independent entities
  • Regulatory audits: Ensuring adherence to industry regulations
  • Examinations: Detailed scrutiny of financial records
  • Independent third-party audit: External impartial assessments
• Penetration testing: Assessing security through simulated attacks
  • Physical: Testing involving real-world access attempts
  • Offensive: Simulated attacks by ethical hackers
  • Defensive: Evaluating an organization’s defense mechanisms
  • Integrated: Comprehensive testing combining various approaches
  • Known environment: Testing with extensive knowledge about the target
  • Partially known environment: Testing with limited target information
  • Unknown...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. You work in third-line support dealing with both cybersecurity and network security assessments. Your organization is looking to assess its security posture by employing ethical hackers to identify vulnerabilities and weaknesses in its defenses. Which of the following types of penetration testing best fits your requirements?
   1. Defensive penetration testing
   2. Passive reconnaissance
   3. Active reconnaissance
   4. Offensive penetration testing
2. Which reconnaissance type aims to gather initial data about the target without alerting or engaging with its systems to minimize the risk of detection?
   1. Active...