nerdexam
(ISC)2

CSSLP · Question #278

You work as a security manager for BlueWell Inc. You are performing the external vulnerability testing, or penetration testing to get a better snapshot of your organization's security posture. Which…

The correct answer is C. Dumpster diving. Searching paper disposal areas for sensitive, improperly discarded documents is a common physical security vulnerability assessment technique used in penetration testing.

Secure Software Testing

Question

You work as a security manager for BlueWell Inc. You are performing the external vulnerability testing, or penetration testing to get a better snapshot of your organization's security posture. Which of the following penetration testing techniques will you use for searching paper disposal areas for unshredded or otherwise improperly disposed-of reports?

Options

  • ASniffing
  • BScanning and probing
  • CDumpster diving
  • DDemon dialing

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    89% (34)
  • D
    5% (2)

Why each option

Searching paper disposal areas for sensitive, improperly discarded documents is a common physical security vulnerability assessment technique used in penetration testing.

ASniffing

Sniffing involves capturing and analyzing network traffic to extract data, which is a network-based attack, not a physical search of disposal areas.

BScanning and probing

Scanning and probing involves using tools to discover open ports, services, and vulnerabilities on network hosts, which is a network-based assessment.

CDumpster divingCorrect

Dumpster diving is a penetration testing technique involving sifting through trash or discarded items to find sensitive information that can be used to compromise an organization's security. This directly describes searching paper disposal areas for unshredded reports.

DDemon dialing

Demon dialing is an older technique used to scan phone numbers for modems or open lines, which is unrelated to physical document disposal.

Concept tested: Penetration testing techniques - Dumpster diving

Source: https://www.cisa.gov/resources-tools/resources/cyber-essentials-physical-security

Topics

#Penetration Testing#Dumpster Diving#Information Gathering#Security Testing

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice