Audits and Assessments
Explain types and purposes of audits and assessments
What you will learn
- Separate internal from external audit by who commissions it and who receives it.
- Explain attestation and what it is worth to a third party.
- Name the penetration test types by prior knowledge.
- Know the difference between a vulnerability scan and a penetration test — the confusion most common here.
Everything in this objective turns on one question: who attests that the controls work, and is that attestation independent? An organisation auditing itself finds what it already knows to look for; an outside party finds what it would rather not see — which is the reason it exists.
Internal vs external audit
| Internal | External | |
|---|---|---|
| Who performs it | A team inside the organisation | An independent body |
| Who the result is for | Management — for improvement | A regulator or a customer — for proof |
| Independence | Limited however good the intent | It is the entire point |
| Frequency | Continuous and relatively cheap | Periodic and expensive |
Terms
| Attestation | A formal signed statement that the controls exist and work. Its value is that it can be handed to a third party instead of every customer auditing you themselves. |
|---|---|
| Vulnerability scan | An automated check for known flaws producing a list. It exploits nothing and proves nothing about exploitability. |
| Penetration test | A human attempt to actually exploit flaws and demonstrate impact. Deeper, slower and more expensive, and it requires documented authorisation. |
| Known environment | The tester knows the full architecture. It saves reconnaissance time and covers more in the same period. |
| Unknown environment | The tester knows nothing. It simulates a genuine outside attacker, and spends a great deal of time on reconnaissance. |
| Partially known | Partial knowledge — the middle ground, and the most practical. |
A scan is not a test
A vulnerability scan is automated and gives you a list of what might be exploitable. A penetration test is human and proves which ones actually are, and what follows from that. If the question asks about "demonstrating impact" or "whether the data can really be reached", the answer is a penetration test, not a scan however often it runs.
Real-world example: three tools for three questions
A bank faces three demands in one month. First: a corporate client wants evidence the bank's controls work before signing — the answer is an attestation from an external auditor, because the client will not accept the bank's word about itself. Second: the security team wants to know which systems are unpatched this week — the answer is a recurring automated vulnerability scan, cheap and repeatable. Third: the board asks "can anyone actually reach customer data?" — the answer is a penetration test under signed rules of engagement, because that question is about impact, not about a list.
What matters on the exam
- "Evidence for a third party" = external audit or attestation. "Internal improvement" = internal audit.
- Scan = an automated list. Penetration test = human proof of impact. The question distinguishes by purpose, not by tool.
- An unknown environment simulates an outside attacker; a known one covers more in less time. The choice follows the purpose.
- No penetration test without documented authorisation. Any scenario that starts testing before the agreement is incomplete.
Quick check
Answer in your head first, then reveal.
A client wants evidence of a provider's security before contracting. Internal or external audit?Reveal the answer
External, usually delivered as an attestation. The evidence's value lies in the independence of whoever issued it; a self-report carries none of that however accurate it is.
When is a vulnerability scan enough, and when is it not?Reveal the answer
Enough for knowing what is unpatched or misconfigured, cheaply and regularly. Not enough when the question is about real impact: is this flaw exploitable, and how far does it reach? That is a penetration test.
What is the benefit of an unknown-environment test, and its cost?Reveal the answer
The benefit is that it simulates a real attacker and reveals what is genuinely visible from outside. The cost is that much of the time and budget goes on reconnaissance rather than testing, so coverage narrows.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.