A Penetration Tester Was Able to Connect to a Company's

question 1161

Multiple Choice

A penetration tester was able to connect to a company's internal network and perform scans and staged attacks for the duration of the testing period without being noticed. The SIEM did not alert the security team to the presence of the penetration tester's devices on the network. Which of the following would provide the security team with notification in a timely manner?

• A) Implement rogue system detection and sensors
• B) Create a trigger on the IPS and alert the security team when unsuccessful logins occur
• C) Decrease the correlation threshold for alerts on the SIEM
• D) Run a credentialed vulnerability scan

---

Definitions:

Upstream Transactions

Transactions where a subsidiary sells goods or services to its parent company.

Unrealised Intragroup Profit

Profit on transactions within a group of companies that has not been realized outside the group, affecting consolidated financial statements.

Opening Inventory

The value of a business's inventory at the start of an accounting period.

NCI Share

Non-Controlling Interest Share, representing the portion of equity in a subsidiary not attributable directly to the parent company owners.