MENU
A security professional has been requested by the Board of Directors and Chief Information Security Officer (CISO) to perform an internal and external penetration
test. What is the BEST course of action?
Suggested Answer: D
Get Premium CISSP Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
31 comments · newest first
AD
Adelina
11 months ago
Surprised that external tests are prioritized!
FA
Fallon
11 months ago
Really? I thought internal tests should come first.
LE
Leanora
11 months ago
Option B is important too, gotta know the policies!
JU
Justine
11 months ago
Totally agree, D is the way to go!
JO
Jovita
12 months ago
I think option D makes the most sense. Start external, then internal.
CA
Caprice
12 months ago
I’m leaning towards option D as well. It seems logical to do the external test first, but I wonder if there are any specific guidelines we should follow when notifying the organization.
BR
Britt
12 months ago
I feel like option A is relevant because understanding regulations is crucial, but I don’t see how it directly relates to the testing process itself.
RO
Rolande
1 year ago
I remember a practice question that emphasized reviewing corporate policies before any testing. So, option B could be important too, but I’m not confident it’s the best first step.
PE
Penney
1 year ago
I think option D makes the most sense since it suggests starting with the external test, which is often a priority. But I'm not entirely sure if we need to notify everyone first.
PH
Phil
1 year ago
Okay, I've got it. A service inventory architecture is all about flexibility and adaptability, so the statement has to be true. Confident in this answer.
CH
Christiane
1 year ago
Hmm, this seems like a tricky one. I'll need to think carefully about the different states a change request can go through.
FE
Felicitas
1 year ago
I'm going to have to go with option D, but I've got to say, 'Configuring a Wireless Access Point (WAP) with the same Service Set Identifier'? That's like a bad joke, right? I mean, who Felicitasn does that these days?
SH
Shawna
1 year ago
It does seem like an odd choice, but it's important to follow the proper procedures for security testing.
CA
Carman
1 year ago
Yeah, setting up a WAP with the same SSID sounds like a risky move.
AL
Alton
1 year ago
Yeah, I don't understand why anyone would configure a WAP with the same SSID for an external test.
ME
Melda
1 year ago
I agree, it's important to notify the organization before conducting the tests.
JA
Jarvis
1 year ago
Option D seems like the best approach for the penetration test.
HU
Huey
1 year ago
I agree, option D seems like the best course of action for the penetration test.
IS
Isadora
1 year ago
Wow, this question really throws a wrench in the works, doesn't it? I'd say option D is the safest bet, but I'd also want to do a thorough review of the data localization requirements. Just to be on the safe side, you know?
FE
Fernanda
1 year ago
Hold up, did you say 'Configuring a Wireless Access Point (WAP) with the same Service Set Identifier'? That's a bit of a curveball! I'm going to have to go with option D on this one.
ME
Merissa
1 year ago
I think so too. It's important to notify the organization before conducting any tests.
FR
Francoise
1 year ago
Yes, I agree. Option D seems like the best course of action in this situation.
MA
Marnie
1 year ago
I'm not sure, this question seems a bit tricky. I'd want to review the corporate policies and procedures first, just to make sure we're not missing anything important.
LE
Leonardo
1 year ago
But shouldn't we also consider data localization requirements and regulations to ensure compliance?
AL
Alison
2 years ago
Hmm, I think option D is the way to go. Doing an external test first, then an internal one, seems like the most comprehensive approach.
LO
Loren
1 year ago
True, it's important to have a solid understanding of the existing security measures before conducting the tests.
JA
Janey
1 year ago
That's a good point, reviewing security policies can help set the foundation for the penetration tests.
CH
Charlene
1 year ago
But wouldn't it be better to review corporate security policies and procedures first to ensure everything is in place?
AL
Alpha
1 year ago
I agree, starting with an external test can help identify vulnerabilities from an outside perspective.
CH
Cherry
2 years ago
I agree with Daniela, it's important to have a solid foundation before conducting any tests.
DA
Daniela
2 years ago
I think we should review corporate security policies and procedures first.