Domain 5 rarely asks you to define the word audit. It hands you a situation and asks which activity fits, or who ought to perform it. The answer choices then sit right next to each other and all sound reasonable. Self-assessment or internal audit? Third-party audit or penetration test? People pick by feel and get burned.
One question sorts all of them. Who is doing the checking, and what does the result prove to whom?
Self-assessment: grading your own homework
An organization examines its own processes against a requirement and forms a picture of where it stands. Useful. Also worth very little to an outsider, because the party with the incentive is the party holding the pen.
On the exam a self-assessment shows up when the scenario wants a cheap internal read before something more formal happens. Does the stem mention getting ready for an upcoming audit? Then the preparation step is the self-assessment.
Internal audit: formal, still inside the house
Same building. More structure. An internal audit checks whether compliance tasks are actually being followed the way they are supposed to be, and it usually gets kicked off and closed out by an audit committee, which is the group that owns risk management at the governance level. The output is findings management is expected to act on.
Keep that committee in mind. Questions like to ask who initiates an internal audit, and the audit committee is the answer nobody reaches for.
External and independent third-party audit: someone with no stake
Here a party from outside reviews your records and reports on where you actually stand, including where you fall short. Plenty of regulations require exactly this, and the requirement exists for a plain reason. Your opinion of yourself carries no weight with a regulator or a customer.
So when a stem involves a payment processor or a regulator wanting assurance, you need the external and independent one. Internal work cannot satisfy it, however rigorous that internal work was.
Attestation: the opinion, not the work
Attestation is an opinion of truth attached to the results of an audit. The audit happens first. Then someone attests to what it found.
That order is the whole exam point. An attestation is a signed statement that the evidence says what it says, so it never stands in for the evidence and it is not a separate flavor of audit.
Penetration test: nobody is reading paperwork
An audit asks whether a control exists and works the way the documentation claims. A pen test asks whether someone can get in anyway. Different question entirely. Testers go at the systems looking for vulnerabilities. Then they try to exploit whatever they turn up.
That gap is where CompTIA likes to live. You can pass an audit with every box ticked and still be easy to breach, because a control can be present and documented and still badly configured. So watch the verb in the stem. Language about demonstrating compliance points at an audit, while language about validating whether a finding is genuinely exploitable points at a pen test.
Knowledge levels, in the current vocabulary
Older study material talks about white box and black box testing, with gray box somewhere in the middle. SY0-701 renamed all three. Learn the new vocabulary even if the video you are watching is a few years old and cheerfully keeps saying black box, because the new names are what shows up in the answer choices.
Known environment means full disclosure of the systems that will be attacked. Fast and thorough. Good when you want depth rather than realism.
Partially known environment means the tester gets some of that information. You pick it when certain systems have to be attacked for sure and you would rather not burn the budget on discovery.
Unknown environment means nothing is provided and the tester has to find everything alone. You will also see it called a blind test. Closest to a real outside attacker, and the slowest of the three, since reconnaissance eats the clock before anything gets exploited.
Teams and targets
Offensive is the red team attacking. Defensive is the blue team identifying attacks in real time and blocking them. Integrated puts both together so each side keeps feeding the other, which is what most organizations actually want.
Physical penetration testing goes at the building rather than the network. The tester tries to get inside without a key, then tries every other way in.
Reconnaissance: one line decides it
Passive reconnaissance collects from outside sources. Social media. Public filings. Job postings that helpfully list your exact stack, and dumpster diving if somebody is feeling committed. You never touch the target, so nothing logs you.
Active reconnaissance means querying the target directly, and that single difference is what the question is testing. A ping scan or a port scan. Anything that puts packets on the network you are studying. Much better data, and much easier to notice.
The trap is that scanning feels like research, so people file it under passive. Does the answer choice touch the target? Then it is active. That rule has no exceptions worth memorizing.
How to drill this
Take any scenario in this area and ask what the output has to prove. Does an outsider have to be able to rely on it? That is an independent third-party audit. If it only has to give your own management a picture, you are looking at a self-assessment or an internal audit. Evidence that a weakness is genuinely exploitable means a pen test. Attestation is whatever gets signed at the end.
Then run scenario questions until the verbs give it away before you finish reading the stem. I write practice questions for this domain over at secplusmastery.com, and the free diagnostic will tell you quickly whether Domain 5 is where your points are leaking. Governance and audit questions are the ones people skip in favor of the fun technical domains, and they carry the same weight as everything else. Free points, basically.
Top comments (0)