An External Red Team Is Brought into an Organization to Perform

question 21

Multiple Choice

An external red team is brought into an organization to perform a penetration test of a new network-based application. The organization deploying the network application wants the red team to act like remote, external attackers, and instructs the team to use a black-box approach. Which of the following is the BEST methodology for the red team to follow?

• A) Run a protocol analyzer to determine what traffic is flowing in and out of the server, and look for ways to alter the data stream that will result in information leakage or a system failure.
• B) Send out spear-phishing emails against users who are known to have access to the network-based application, so the red team can go on-site with valid credentials and use the software.
• C) Examine the application using a port scanner, then run a vulnerability scanner against open ports looking for known, exploitable weaknesses the application and related services may have.
• D) Ask for more details regarding the engagement using social engineering tactics in an attempt to get the organization to disclose more information about the network application to make attacks easier.

---

Definitions:

Interest-rate Cost

The expense incurred by borrowing funds, typically expressed as a percentage of the total amount borrowed.

Expected Rate

The anticipated return on an investment or the average rate at which an event is predicted to occur over a specific period.

Patents

Legal documents granted by governments that provide inventors exclusive rights to their inventions, preventing others from making, using, or selling the invention for a certain period of time.

Trademarks

Legal designations that protect brand names, logos, and other identifiers from being used without permission.