ISA 4.0 Module 6 – Topic Wise

Module 6: Technical Security Testing and VA/PT Audits Vulnerability Assessment, Penetration Testing, Network Security, Attack Vectors & Audit-Grade Testing Course Overview & Scope: Auditing technical security requires Chartered Accountants to understand how adversaries discover vulnerabilities and compromise enterprise networks. This course comprises 946 practice questions covering global security testing methodologies (NIST SP 800-115, OWASP, OSSTMM, PTES). Candidates study the differences between Vulnerability Assessments (VA) and Penetration Testing (PT), black-box/white-box/gray-box testing, network architecture reviews, firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), wireless security, port scanning, reconnaissance, social engineering, attack simulations, evaluating third-party VA/PT reports, and verifying management remediation. Key Regulatory Frameworks & Standards Covered: NIST SP 800-115 (Information Security Testing and Assessment), OSSTMM 3, OWASP Testing Guide v4, PTES (Penetration Testing Execution Standard). Core Audit Competencies Tested in Quizzes:

• Differentiating Vulnerability Assessment (automated scanning) from Penetration Testing (active exploitation).
• Evaluating VA/PT scope, rules of engagement, indemnity clauses, and testing authorization.
• Auditing network security controls, firewall rulebases, DMZ segmentation, and IDS/IPS tuning.
• Critically reviewing third-party VA/PT reports, CVSS vulnerability ratings, and verifying false positive filtering.
• Evaluating technical remediation testing, patch validation, and re-testing procedures.

Detailed Topic-Wise Active Quiz Index (Module 6)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: Introduction to Security Testing	Vulnerability Assessment and Penetration Testing	60
	Physical and Environmental Controls	8
	Testing	4
	Concepts of IS Audit – Learning Objectives	1
Chapter 2: Security Testing in the Business Environment	Vulnerability Assessment and Penetration Testing	60
	Physical and Environmental Controls	8
	Application of Cryptographic Systems	4
Chapter 3: Global Methodologies for VA/PT	Vulnerability Assessment and Penetration Testing	60
	Vulnerability Assessment and Penetration Testing – Penetration Testing	36
	Firewall	193
	Public Key Infrastructure (PKI)	11
Chapter 4: Auditing Methods for Organizations	Auditing Network Security Controls	114
	Operating System	11
Chapter 5: OWASP Application & API Security Testing	Vulnerability Assessment and Penetration Testing	60
	Network Threats and Attacks – Scripts	7
	Network Threats and Attacks – Session Hijacking	3
	Network Threats and Attacks – Web Defacement	3
Chapter 6: Network & Infrastructure VA/PT	Network Security Controls	17
	Network Threats and Attacks – Port Scan	6
	Network Threats and Attacks – Reconnaissance	6
Chapter 7: NIST SP 800-115 Structured Testing	Vulnerability Assessment and Penetration Testing	60
	Vulnerability Assessment and Penetration Testing – Penetration Testing	36
	Testing	4
Chapter 8: Methodology Selection & Audit Reporting	Vulnerability Assessment and Penetration Testing	60
	Auditing Network Security Controls	114
	TOTAL ACTIVE QUESTIONS IN MODULE 6:	946