Explain types and purposes of audits and assessments
Internal and external audits, attestation, and penetration testing types: known, partial, and unknown environment.
- Reading time
- 16 min read
- Flashcards
- 14 cards
- Practice questions
- 9 questions · 2 PBQs
Short and highly testable. Two halves: audits and assessments, and penetration testing. The penetration testing terminology changed in SY0-701, and the old terms are now wrong answers.
Internal vs external
Internal audit
- Performed by the organisation's own staff
- Compliance function, audit committee, self-assessments
- Cheaper, more frequent, less independent
External audit
- Performed by an outside party
- Regulatory examinations, independent third-party audits
- Costlier, less frequent, carries more weight
The tellIndependence is the whole difference. An internal team auditing its own organisation cannot carry the same weight as an outside assessor with nothing at stake.
Self-assessment is the least independent form — the team evaluating its own controls. Useful for readiness, insufficient for assurance.
Attestation appears here as well as in 5.4: a formal statement that findings are accurate.
Regulatory examination is an external audit conducted by a regulator, which carries enforcement power the others do not.
Penetration testing
The environment knowledge terms
This is the change worth knowing. SY0-701 uses:
| Current term | Formerly | Meaning |
|---|---|---|
| Known environment | White box | Tester has full information — architecture, credentials, source |
| Partially known environment | Grey box | Tester has limited information |
| Unknown environment | Black box | Tester has no prior information, like a real attacker |
Check yourself
A tester is given no information about the target beyond its name, and must discover everything as a real attacker would. Which type of test is this?
Test types
Physical — attempting physical entry: tailgating, lock bypass, badge cloning. Offensive — the red team, attacking. Defensive — the blue team, defending and detecting. Integrated — offensive and defensive working together, often called purple teaming.
Reconnaissance
Passive reconnaissance
- No interaction with the target
- Public records, WHOIS, social media, search
- Undetectable by the target
Active reconnaissance
- Direct interaction — scanning, probing
- Produces far more detail
- Detectable, and may be logged
The tellIf the target could see it in their logs, it is active. Passive reconnaissance leaves no trace on the target because you never touch it.
Check yourself
A tester reviews the target's public DNS records, employee LinkedIn profiles and published job adverts. What is this?
Job adverts are a genuinely useful passive source: an advert seeking an engineer with experience in a specific firewall tells you what the organisation runs.
Choosing between them
A vulnerability scan finds known weaknesses broadly and shallowly. A penetration test proves exploitability narrowly and deeply. An audit verifies that a process is being followed. They answer different questions, and a stem asking whether a weakness is genuinely exploitable wants the penetration test.