VA+ (Vulnerability Assessment Plus)

The VA+ assessment:

1. Practical Element – two hours, open book

30 mins – Short scoping exercise where you will be briefed on the assessment you are to conduct. You are allowed and expected to ask questions and contribute to the scoping meeting.

1 h 30 mins – Configure and conduct your vulnerability assessment.

Some time to prepare for the wash up meeting (you can write out your answers, create a power point, prepare some bullet points, create a mind map – whatever will help you give a summary of the issues found). Plus some time to prepare your answers to technical questions.

2. Wash up meeting and technical questions – 30 mins – open book

You will be asked to present the result of the vulnerability assessment (verbally or with any media prepared as given above).

You will be asked for your technical answers.

Exam Tips:

If you are asked to produce an executive summary the language should be aimed at non-technical executives and should include organisation specific outcomes and consequences.

If you are asked to produce a technical summary this should be a “summary” not the finding details.

If you are asked for remediation advice you are expected to go beyond the tool output provided.

If you have any assumptions or questions regarding the scenarios either state your assumption in your answer or ask your assessor for guidance.

3. Multiple-Choice Quiz – 30 questions, in 30 minutes. Closed book.

You will be asked a series of questions with a single correct answer from four options.

The multiple-choice element allows the candidate to demonstrate their wider understanding of cybersecurity in terms of knowledge, experience, and skills.

The topics and domains are wide in scope and examine topics from an historic stance as well as looking at current practices.

Multiple Choice Study

The multiple-choice element draws from a number of study domains:

Enumeration

The examination and scrutiny of devices, software, and services available on a network which may give information or indication to further disclose the inner workings, structure, and secrets of an unknown system.

An example might be to question what tools are currently available to gather information from a device offering domain name system (DNS) services.

Encryption / Cryptography

The practice and study of securing communications in the presence of adversaries. An example question might be to describe vulnerabilities in different versions of secure shell (SSH).

Laws

The laws, rules, regulations, best practice, and ethics associated with working in cybersecurity. Clients and customers put a lot of good faith in the operatives involved in cybersecurity engagements including the disclosure of information and the trust that is implied by allowing their systems to be scrutinised. An example might be to question what methods and techniques could be used by a cybersecurity consultant to stay within a scope and which laws, rules, regulations, best practices, and ethics would be called into question if not adhered to.

Linux operating system

The use of the Linux operating system has many benefits for the cybersecurity consultant and being aware of these benefits is important. Furthermore, the Linux operating system is used in many industries and is highly likely to be present in some form at most if not all customer sites. Most of the network devices as well as many servers use a Linux operating system.

Networking

Knowledge and understanding of the protocols used for data in transit is invaluable to the cybersecurity consultant. Even though some of the work can be simplified by the use of automated tools in order to validate results, mitigate issues and troubleshoot problems the consultant requires a solid background in low level computer networking. Networks come in many flavours such as wired ethernet, wireless, local, and wide area. An example might be to explain how network mapping tools can distinguish between open, closed, and filtered TCP ports on a local area network. 

Testing

The testing domain is better described as general cybersecurity knowledge and the soft skills required by a penetration tester. Many cybersecurity qualifications require an understanding of security models, frameworks, concepts, and definitions of cybersecurity terms. An example might be to describe the technical controls involved in the DDPRR security model.

Vulnerabilities

The vulnerability topic or domain is knowledge of vulnerabilities both current and historic. Although an emphasis is placed on vulnerabilities which result in exploitation where remote code execution is possible, knowledge of vulnerabilities which result in information disclosure, denial of service and other types are also part of this domain. An example might be to describe how a particular SSL/TLS vulnerability works.

Windows

The Microsoft Windows operating system is extremely popular with users and administrators alike. Over the years vulnerabilities and misconfiguration of the Windows operating system has resulted in companies being compromised. This domain is specifically for Microsoft Windows operating system knowledge relating to cybersecurity. An example might be to question where passwords are typically stored on a specific Microsoft Windows server version.

OSMisc

There are other operating systems in use for example Apple, Android, and Unix which although similar might not be covered by the Windows and Linux Domains. An example question might be to ask about ubiquitous vulnerabilities found on Unix systems.

WebApps

The web application domain covers the testing, auditing and scrutiny of web applications, mobile applications, and application programable application interfaces (APIs). An example question might ask about a vulnerability specifically associated with web application testing such as session fixation.