Audits, assessments and where penetration testing fits

Objective 5.5 in this course covers audits and assessments — CompTIA's scope note for it explains attestation, internal and external audits, and penetration testing. It is the Domain 5 capstone: an audit is where governance, risk, third-party management and compliance are all tested at once.

Why this matters

This objective supplies two reliable question types. The first is internal-versus-external and who each serves. The second is the penetration testing environment terms — known, partially known, unknown — which replaced the older white/grey/black box language and which the exam asks about directly.

It is also where the course closes a loop. Every control in Domains 1 to 4 is eventually checked by somebody, and the form that check takes is one of the things in this lesson.

The lesson

Internal: compliance, audit committee, self-assessments

Internal audit is performed by the organisation's own people, and its defining property is independence from the function being audited. An internal audit team reports to the audit committee or the board, not to the head of IT, because an auditor who reports to the person they are auditing cannot produce an uncomfortable finding.

The internal forms CompTIA names:

• Internal compliance audit — checking against a specific obligation: regulation, contract, or an adopted standard. Output is a finding list with owners and dates.
• Audit committee — the governance body, usually a subcommittee of the board, that commissions audits, receives the findings, and holds management accountable for closing them. It is the structural answer to "who makes sure the findings get fixed".
• Self-assessment — the team assessing its own controls against a checklist or benchmark. Cheapest, most frequent, and least independent. Genuinely useful for finding and fixing problems before anyone else does; not evidence for anybody external, because it is self-reported.

The value of internal audit is frequency and access. They can look at anything, whenever, and they know the organisation. Their limitation is independence: however well structured, they are employees.

External: regulatory, examinations, assessment, independent third-party audit

External audit is performed by someone outside the organisation, and its defining property is independence — which is exactly what internal audit cannot fully supply, and is why both exist.

The forms:

• Regulatory audit — conducted by, or on behalf of, a regulator. Not optional, and its findings carry enforcement consequences.
• Examinations — a regulator's formal review, common in financial services.
• External assessment — a third party evaluating against a standard or giving an expert opinion, without the formality of a certification audit.
• Independent third-party audit — the certification audit: ISO 27001, SOC 2, PCI DSS assessment. Produces the report or certificate that other organisations rely on, which is the artefact your customers ask for and the one you ask your vendors for in 5.3.

The exam's discriminator: internal audits serve management and improvement; external audits serve outside parties who need assurance they cannot get by asking you. If a scenario is about satisfying a customer, a regulator or a partner, it is external. If it is about finding and fixing problems, internal.

Two practical points. Audit findings should be tracked to closure with owners and dates — an audit whose findings are not tracked is a report, and repeat findings across consecutive audits are a governance failure rather than a technical one. And the scope of any audit is the first thing to read, as 5.3 established from the other side: a clean report on a narrow scope says nothing about what was outside it.

Attestation, and what a signature on it means

Attestation is a formal declaration that something is true, made by someone who takes responsibility for the statement.

Three kinds appear on this exam:

• Management attestation — senior management formally stating that controls are in place and effective. Under some regimes this carries personal liability, and that is the mechanism: it makes a corporate claim into an individual's exposure, which changes how carefully it is checked before signing.
• Auditor attestation — the independent auditor's opinion, as in a SOC 2 attestation report.
• Vendor attestation / self-attestation — a supplier asserting their own compliance, which is the weakest form from 5.3's evidence hierarchy and is self-reported.

What a signature means depends entirely on who signed and what they checked. An auditor's attestation rests on testing they performed and documented; a vendor's rests on their own account of themselves. Treating the second as equivalent to the first is the mistake this term exists to prevent.

Penetration testing: physical, offensive, defensive, integrated

Penetration testing is authorised, simulated attack to find exploitable weaknesses. It differs from a vulnerability scan in the way Domain 4 described: a scan reports what a tool recognises, a test establishes what is actually exploitable and chains findings a scanner reports as individually minor.

CompTIA's types:

• Physical — testing physical controls: doors, badge systems, reception procedures, tailgating, and whether someone in a high-visibility jacket can walk into the server room.
• Offensive — the red team: simulating the attacker.
• Defensive — the blue team: the defenders, and an exercise assessing detection and response rather than prevention.
• Integrated — purple team: offensive and defensive working together, with the attackers explaining what they did and the defenders checking whether they saw it, and building detections in the same session. It produces more improvement per hour than a conventional red team, because the feedback loop is immediate rather than in a report six weeks later.

The framing to carry: a red team engagement tests detection and response, not just whether a vulnerability exists. If a scenario asks how to test whether the security team would notice an intrusion, the answer is a red team or purple team exercise, not a vulnerability scan.

Rules of engagement from 5.3 govern all of these, and written authorisation is what separates a penetration test from a crime.

Known, partially known and unknown environment, and reconnaissance types

CompTIA's current terminology for how much the tester is told. This replaced the white/grey/black box language, and the exam uses the new terms.

• Known environment (formerly white box) — the tester is given full information: architecture, source code, credentials, documentation. Most efficient use of the time, because none of it is spent discovering what you could have simply told them. Finds the most issues per hour. Does not simulate a real attacker's starting position.
• Partially known environment (grey box) — some information, typically standard user credentials and a general description. The usual commercial choice, and a good proxy for an attacker who has already achieved a foothold or an insider.
• Unknown environment (black box) — the tester is told nothing beyond the target. Most realistic as a simulation of an external attacker, least efficient, and it can spend most of the engagement on reconnaissance that a known-environment test would skip. A clean result may mean the estate is strong or that the tester ran out of time.

The trade to state: known finds the most; unknown simulates most realistically; partially known is the usual compromise.

Reconnaissance types:

• Passive — gathering information without touching the target: public records, DNS, certificate transparency logs, job adverts naming your technologies, employee profiles, breach dumps, search engines. Invisible to the target, and it establishes the organisation's genuine external footprint, which is frequently larger than the asset inventory claims.
• Active — interacting directly: scanning, enumeration, probing. Richer and detectable, which makes it — usefully — a test of whether your monitoring notices.

A closing thought that ties Domain 5 together. An audit asks whether the controls you say you have exist. A penetration test asks whether they work. A red team exercise asks whether you would notice. They answer three different questions, and an organisation that does only the first has evidence of compliance without evidence of security — which is the distinction this whole domain is built to make.

What to take into the exam

• Internal audit serves management and improvement; external audit serves outside parties who need independent assurance.
• Self-assessment is useful internally and is not evidence for anyone external.
• Attestation's weight depends on who signed and what they tested; management attestation can carry personal liability.
• Known / partially known / unknown replaced white / grey / black box. Known finds most, unknown is most realistic, partially known is the usual choice.
• Passive reconnaissance never touches the target; active is detectable and tests your monitoring.
• Purple team is integrated offensive and defensive, with immediate feedback.