CoreQ Academy5.5 Explain types and purposes of audits and assessments.
Audits and assessments give independent evidence that controls work. Penetration tests go further by proving what an attacker could actually do.
Attestation and internal
- Attestation
- A formal statement by an auditor or manager that controls meet requirements.
- Compliance (internal)
- Internal checks that the organisation follows laws and policies.
- Audit committee
- Board-level group overseeing audits and financial reporting.
- Self-assessments
- Teams evaluate their own controls, often with questionnaires.
External
- Regulatory
- Audits required and performed by or for regulators.
- Examinations
- Formal inspections by regulators or external auditors.
- Assessment
- Evaluation of controls against a standard, often by a third party.
- Independent third-party audit
- Audit by an unbiased outside firm, such as a SOC 2 audit.
Penetration testing
- Physical
- Testing whether testers can get into buildings and secure areas.
- Offensive
- Red team: simulating real attackers.
- Defensive
- Blue team: detecting and responding to the attack.
- Integrated
- Purple team: offensive and defensive teams work together to improve detection.
- Known environment
- Testers get full information (white box).
- Partially known environment
- Testers get some information (gray box).
- Unknown environment
- Testers get no prior information (black box), like a real outside attacker.
- Reconnaissance
- Gathering information about the target before testing.
- Passive
- Collecting information without touching target systems (OSINT, public records).
- Active
- Directly interacting with the target (port scans, banner grabbing); can be detected.
Check your understanding
Knowledge quiz · pass mark 80%
- Port scanning the target is passive reconnaissance.
- Testers receive network diagrams and source code before testing. This is a:
- Searching public records and social media about a target without contacting its systems is:
- Red and blue teams work together to improve detections. This is:
Original CoreQ Academy material, mapped to objective 5.5 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.