Day 1 Capstone
Welcome to the AUD1 hands-on challenge!
The questions within this challenge are designed to reinforce the hands-on workbook activities that you have experienced while taking this class. With this in mind, this challenge has been designed to push you to expand your knowledge by applying the things that you have learned to similar, but not identical, situations and problems.
As you work through the challenge, please feel free to call on your instructor if you need any assistance. Keep in mind that you are not required to answer the questions in order, nor are you required to answer all of the questions in all of the levels. If you find a section isn't particularly relevant for you, it's okay to skip it!
General Knowledge
This section contains basic questions from a variety of the topics covered in the class. You should be able to answer all of these questions based on discussions with your instructor and the content of the course books.
Auditing
The primary objective of an auditor is to measure and report on _______________.
Hints
An auditor might have findings, but they are not the purpose.
The auditor is also not focused on finding vulnerabilities.
Control gaps and uncontrolled security issues represent the kinds of things that this term represents.
Audit Standards
What is the numeric designator of the ISACA guideline which describes the required sections for an audit report? Your answer will be a 4-digit integer.
Hints
ISACA's IT Audit Framework (ITAF) includes comprehensive standards and guidelines for performing IT audits.
Standard 1401 requires issuance of a report for audits.
The guidelines for writing the report are related to Standard 1401 and presented in the next section of the ITAF.
Control Objectives
The parts of the CIA triad of control objectives are confidentiality, ____________ and availability.
Hints
This control objective involves ensuring that systems and data are in a known-good state.
Controls for this objective will be concerned with completeness, accuracy and validity of data and transactions.
Controls like authentication and hashing support this objective.
Risk Assessment
A(n) _________ tree can be used to find the underlying causes of system and control failures by asking questions about what must be true for a failure to happen.
Hints
This tree is used as the second step for consequence/cause analysis (CCA).
It helps to identify missing controls by asking what condition allowed a failure to occur.
This type of analysis can find underlying faults in our control environment.
Capability Maturity Model
Which numeric level of the capability maturity model is commonly labeled "Optimizing?" Your answer should be an integer.
Hints
The CMM and CMMI level names may vary, but "optimizing" is generally used to describe this level in all versions of the model.
It's easy to search the web for descriptions of the maturity models.
Optimizing is very high in the model.
JSON Parsing
What is the name of the cross-platform tool which can "slice and filter and map and transform" JSON data, similarly to sed, awk and grep?
Hints
This tool is similar to sed, but used for JSON data.
At its simplest, it acts as a pretty-printer for JSON data.
It can also work with JSON arrays and create custom JSON objects.
Nmap
What is the nmap flag to specify TCP connect() scanning? Your answer should include the dash and is case sensitive.
Hints
nmap is installed on your Ubuntu and Alma VMs. nmap -h will get the help output.
There's also a good nmap book online.
You used this option in some of your labs.
Networking
What is the IPv4 address of the www.aud507.com public Wiki website?
Hints
Is there a way that you can translate the name of the server into an IP address?
Your web browser does this transparently, but it can be challenging to get the answer this way. You will most likely want to use a command interpreter to find an answer.
What happens when you try to ping the Wiki webserver?
Cloud Service Models
What is the four-letter abbreviation for the cloud service model in which the customer is given full access to create and manage their own networks, virtual machines, storage and other services?
Hints
There are dozens of cloud service models, but this one is very commonly used.
In this model, the customer can manage the virtual infrastructure themselves.
The ability to manage infrastructure is provided as a service the customer can use.
Cloud Services
What is the abbreviated name for the AWS service which provides compute capabilities? Your answer will be three characters, and include letters and numbers.
Hints
This service allows customers to create and manage virtual machine instances.
The service is "elastic" because instances can be created and removed at will, either programmatically or through the web console.
This service allows customers to manage their own compute cloud.
Shared Responsibility
Google introduced a cooperative concept beyond the shared responsibility model, called shared ________, which includes "prescriptive" guidance on how to use the cloud securely.
Hints
Shared responsibility models assume that it's up to the customer to know how to operate securely.
This model provides automation templates to make it easier to create secure environments.
In this model, the fate of the customer's cloud deployment is shared with the provider.
Cloud Compliance
Which level of the Cloud Security Alliance (CSA) STAR program includes a 3rd-party certification? Your answer will be an integer.
Hints
STAR includes multiple levels, with self-assessment at the bottom.
Third-party testing offers a higher level of assurance than self assessment.
The highest level of STAR certification is not yet implemented.