Feedback for Rules of Engagement

Submission Feedback

11.2.2: Develop a formal plan for a penetration test including security tool recommendations for management.: Need to include some security tool recommendations for management.

13.1.4: Convey to management the dangers that social engineering presents to an organization.: Provide more details about the dangers that social engineering presents to an organization.

Feedback for Scanning Plan

Submission Feedback

1.2: Communicate using appropriate writing conventions, including spelling, grammar, mechanics, word choice, and format.: Missing in-text references

2.1: Identify and frame a problem or issue.: I would start with passive and active reconnaissance and then get into scanning phase. Remember the difference between active reconnaissance and footprinting. Also how active reconnaissance differentiates from active scanning.

12.1.2: Identify vulnerabilities within a company’s network and explain mitigation strategies to management.: What are the mitigation strategies?

13.1.4: Convey to management the dangers that social engineering presents to an organization.: Need to explain the dangers that social engineering presents to the organization.

Feedback for Gaining Access Plan

Submission Feedback

1.2: Communicate using appropriate writing conventions, including spelling, grammar, mechanics, word choice, and format.: I took one point because there are some inconsistencies with APA format (i.e. font, spaces and so on). References are good, so for that reason I didn’t take more.

2.1: Identify and frame a problem or issue.: You provided enough details about gaining access, but need to identify and frame the problem or issue.

11.2.2: Develop a formal plan for a penetration test including security tool recommendations for management.: Did a better job including some security tool recommendations for management, but did not develop a formal plan for a penetration test.

13.2.1: Scan networks and enumerate available hosts and describe characteristics of common operating systems.: Stick to the competency. In this case “Scan networks and enumerate available hosts and describe characteristics of common operating systems.” Gave you some points, but you didn’t cover it well enough.

13.2.3: Use industry tools to identify and remediate security issues.: You mentioned some industry tools, but not to identify and remediate security issues.