Baseline Security Assessment for Corporate IT Infrastructure | Exam SY0-601: CompTIA Security+

Assessment of Corporate IT Infrastructure

Prev Question Next Question

Question

A security administrator is tasked with conducting an assessment made to establish the baseline security posture of the corporate IT infrastructure.

The assessment must report actual flaws and weaknesses in the infrastructure.

Due to the expense of hiring outside consultants, the testing must be performed using in-house or cheaply available resource.

There cannot be a possibility of any requirement being damaged in the test.

Which of the following has the administrator been tasked to perform?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

D.

The security administrator has been tasked with conducting a baseline security posture assessment of the corporate IT infrastructure. The purpose of this assessment is to identify the actual flaws and weaknesses in the infrastructure. The assessment must be conducted using in-house or cheaply available resources and should not cause any damage to the system being assessed.

Option A, Risk transference, is not the correct answer as it refers to the process of transferring the risk associated with a particular system or process to a third party. This involves shifting the burden of responsibility and accountability for any security breaches or incidents to the third party.

Option B, Penetration test, is a type of security assessment that involves attempting to breach the security defenses of a system to identify vulnerabilities and weaknesses. This is a comprehensive test that attempts to simulate an actual attack scenario to evaluate the effectiveness of the system's defenses. A penetration test can be expensive and requires specialized skills and tools.

Option C, Threat assessment, is a type of security assessment that involves identifying and analyzing potential threats and risks to a system or organization. This assessment aims to understand the likelihood of an attack occurring and the potential impact of such an attack.

Option D, Vulnerability assessment, is the process of identifying and analyzing vulnerabilities and weaknesses in a system. This type of assessment focuses on identifying vulnerabilities that could be exploited by an attacker to gain unauthorized access to the system or its data. Vulnerability assessments are less expensive and can be conducted using automated tools and techniques.

Given the requirement for a low-cost assessment that does not cause any damage to the system, the correct answer is D, Vulnerability assessment. This assessment is a more focused and less comprehensive approach compared to a penetration test, making it suitable for this scenario. It also does not involve attempting to breach the security defenses, which reduces the risk of causing any damage to the system.