Security Assessment & Penetration Testing

Assurance and the Limits of Penetration Testing

Evidence: Mixed

Revision: Available · 4 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 2): a penetration test is performed within a defined scope and timeframe, cannot guarantee that every vulnerability is found, and an attacker may have considerably more time than the tester.
• Classroom (Session 2): penetration testing is one component of an ongoing security programme, not a one-time guarantee that an organisation cannot be compromised.
• Classroom (Session 4): certification and a continuously staffed SOC provide assurance and capability but cannot guarantee that every attack is prevented.
• Supplementary: self-assessment, independent technical verification, certification audit, penetration testing and monitoring each show something narrower than overall security, and systems change and new vulnerabilities emerge after a test.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Assurance and the Limits of Penetration Testing — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 2): a penetration test is performed within a defined scope and timeframe, cannot guarantee that every vulnerability is found, and an attacker may have considerably more time than the tester.
• Classroom (Session 2): penetration testing is one component of an ongoing security programme, not a one-time guarantee that an organisation cannot be compromised.
• Classroom (Session 4): certification and a continuously staffed SOC provide assurance and capability but cannot guarantee that every attack is prevented.
• Supplementary: self-assessment, independent technical verification, certification audit, penetration testing and monitoring each show something narrower than overall security, and systems change and new vulnerabilities emerge after a test.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Assurance and the Limits of Penetration Testing — Supplementary Study Guide explanation · Assurance answers a specific question; What a penetration test is; Why a breach can follow a clean test; Thinking like an attacker; Using assurance well

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.

Full penetration-testing methodology

Evidence: Not yet recorded

Revision material not yet added · 0 questions · 0 flashcards

Exam relevance

• CPSA · A1 · direct

  This concept relates to the cited objective. Course coverage and authored revision do not establish full objective coverage.

Verified for CPSA: 0 of 0 questions and 0 of 0 flashcards. The mapping does not verify the others.

Reviewed revision scope

Revision scope has not yet been authored and reviewed.

Recorded evidence

Not yet recorded in classroom, Study Buddy or Study Guide learning. This does not prevent revision.

Reviewed 2026-09-16. Reviewed against the linked repository learning record. Scope is introductory; no practical competence or complete objective coverage is implied.

Testing authorisation

Evidence: Classroom-supported

Revision: Available · 2 questions · 1 flashcard

Exam relevance

• CPSA · A2 · supporting

  Written permission is supporting context; detailed law and compliance are not evidenced.

Verified for CPSA: 0 of 2 questions and 0 of 1 flashcard. The mapping does not verify the others.

Reviewed revision scope

• Obtain written permission before security testing.
• Authorisation defines what is allowed.

• Session 1: Cyber Fundamentals Part 1 — Classroom session record

Recorded evidence

• Obtain written permission before security testing.
• Authorisation defines what is allowed.

• Session 1: Cyber Fundamentals Part 1 — Classroom session record · Key Takeaways; Attack Chain; Threat Actors; Risky User Behaviour; Thinking Like an Attacker; Practical Relevance

Reviewed 2026-09-16. Reviewed against the linked repository learning record. Scope is introductory; no practical competence or complete objective coverage is implied.

Testing Scope, Discovery and Disclosure

Evidence: Mixed

Revision: Available · 5 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 1): permission and the purpose of an activity distinguish legitimate security testing from criminal activity.
• Classroom (Session 2): discovering a weakness, as in the bank-door analogy, does not give permission to exploit it.
• Supplementary: an authorised test is limited to its agreed scope of systems, times and techniques, and anything outside that scope is unauthorised.
• Supplementary: responsible disclosure reports a weakness privately to the organisation that can fix it and allows time for a fix before details are published.
• Supplementary: in the UK, the Computer Misuse Act 1990 makes unauthorised access to computer material an offence; permission from someone entitled to give it separates authorised testing from an offence.

• Session 1: Cyber Fundamentals Part 1 — Classroom session record
• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Ethics, Authorisation and Responsible Disclosure — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 1): permission and the purpose of an activity distinguish legitimate security testing from criminal activity.
• Classroom (Session 2): discovering a weakness, as in the bank-door analogy, does not give permission to exploit it.
• Supplementary: an authorised test is limited to its agreed scope of systems, times and techniques, and anything outside that scope is unauthorised.
• Supplementary: responsible disclosure reports a weakness privately to the organisation that can fix it and allows time for a fix before details are published.
• Supplementary: in the UK, the Computer Misuse Act 1990 makes unauthorised access to computer material an offence; permission from someone entitled to give it separates authorised testing from an offence.

• Session 1: Cyber Fundamentals Part 1 — Classroom session record · Key Takeaways; Attack Chain; Threat Actors; Risky User Behaviour; Thinking Like an Attacker; Practical Relevance
• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Ethics, Authorisation and Responsible Disclosure — Supplementary Study Guide explanation · Permission and scope; Discovering is not permission to exploit; Responsible disclosure; Reporting concerns inside an organisation; Legal and professional considerations

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.