In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent…

A penetration testing is a method of evaluating the security of a computer system or network by

simulating an attack from a malicious source.

The process involves an active analysis of the system for any potential vulnerabilities that may result

from poor or improper system

configuration, known or unknown hardware or software flaws, or operational weaknesses in process

or technical countermeasures. This

analysis is carried out from the position of a potential attacker, and can involve active exploitation of

security vulnerabilities. Any security

issues that are found will be presented to the system owner together with an assessment of their

impact and often with a proposal for

mitigation or a technical solution. The intent of a penetration test is to determine feasibility of an

attack and the amount of business impact of

a successful exploit, if discovered. It is a component of a full security audit.

Answer C is incorrect. A paper test is the least complex test in the disaster recovery and business

continuity testing approaches. In this

test, the BCP/DRP plan documents are distributed to the appropriate managers and BCP/DRP team

members for review, markup, and

comment. This approach helps the auditor to ensure that the plan is complete and that all team

members are familiar with their

responsibilities within the plan.

Answer D is incorrect. A walk-through test is an extension of the paper testing in the business

continuity and disaster recovery

process. In this testing methodology, appropriate managers and BCP/DRP team members discuss and

walk through procedures of the plan.

They also discuss the training needs, and clarification of critical plan elements.

Answer A is incorrect. A full operational test includes all team members and participants in the

disaster recovery and business

continuity process. This full operation test involves the mobilization of personnel. It restores

operations in the same manner as an outage or

disaster would. The full operational test extends the preparedness test by including actual

notification, mobilization of resources, processing

of data, and utilization of backup media for restoration.