Departments › Cyber Security › Module IV › Conduct Security Assessment And Testing

Conduct Security Assessment And Testing

Cyber Security · Level 6  ·  7 Chapters

Compiled by: Winnie Apiyo

Can I download Conduct Security Assessment And Testing notes as a PDF?

Yes. 1 CDACC past paper for Conduct Security Assessment And Testing downloads as a PDF, free, with no account and no payment. The notes download as a PDF too: every chapter has a Download PDF button above its notes. Sign in and click it. Each download comes from your plan's monthly allowance or from credits. To read before you sign in, the first topic of every chapter opens to anyone, and a Profplanet plan opens the remaining topics. See the 1 free past paper for this unit.

▣

What Conduct Security Assessment And Testing covers

In this unit, you will be able to confidently conduct thorough security assessments by reviewing organizational policies, mapping out critical assets, and using advanced tools to scan and enumerate systems. You will learn to identify vulnerabilities and potential risks through detailed analysis of networks, user roles, and third-party connections, empowering you to protect real-world environments effectively. By the end, you’ll have the skills to gather and interpret vital security data, helping organizations strengthen their defenses with precision and care.

■

Careers after Conduct Security Assessment And Testing

In Kenya’s rapidly growing digital and physical security landscape, the ability to conduct thorough security assessments and testing is a highly valuable skill. Whether you aim to work in established organizations or start your own security consultancy, mastering these skills opens doors to numerous career opportunities and entrepreneurial ventures that protect Kenya’s critical infrastructure and business assets.

  • Employment opportunities: You can find roles in government agencies like the National Transport and Safety Authority (NTSA), county governments managing public infrastructure, energy companies such as KenGen and Kenya Power, and financial institutions that require robust cybersecurity measures. The booming ICT sector, including tech hubs in Nairobi and Mombasa, also employs security professionals to safeguard data and networks.

  • Jua Kali and informal sectors: Small-scale businesses and matatu operators increasingly rely on digital payment systems and mobile apps, creating demand for security assessments to prevent fraud and data breaches. You could offer affordable security audit services to these enterprises, helping them build trust with customers.

  • Agribusiness and manufacturing: Organizations like the Kenya Tea Development Agency (KTDA) and agro-processing firms need security experts to protect sensitive data and operational technology from cyber threats and sabotage.

  • Self-employment and entrepreneurship: With your skills, you can start a consultancy offering security assessments, penetration testing, and compliance audits to SMEs and public sector clients. This is a growing market as Kenyan businesses become more aware of cybersecurity risks.

  • Why it matters: Mastering security assessment and testing equips you to be a guardian of Kenya’s digital and physical assets, contributing to the safety and resilience of communities and businesses. Your expertise will be crucial in preventing costly security breaches, supporting economic growth, and building a safer future for all Kenyans.

Step confidently into this vital role and become a trusted security professional who makes a real difference in Kenya’s development journey!

Chapters

1
Gather Information About Organization and its Systems
8 topics
Open chapter →
2
Scan and Map the Network
11 topics
Open chapter →
3
Enumerate Target Resources
10 topics
Open chapter →
4
Exploit Known Vulnerabilities
7 topics
Open chapter →
5
Perform Social Engineering
7 topics
Open chapter →
6
Conduct System hacking
21 topics
Open chapter →
7
Prepare Security Assessment and Testing Report
9 topics
Open chapter →

1 past paper for this unit →

What Conduct Security Assessment And Testing covers: 41 main topics in 7 chapters

1. Gather Information About Organization and its Systems

  1. 1.1 Explain the importance of reconnaissance on a target system, network, or organization
  2. 1.2 Identify different types of reconnaissance
  3. 1.3 Use OSINT (Open-Source Intelligence) tools to collect publicly available data
  4. 1.4 Demonstrate the use of WHOIS lookup, DNS enumeration, and Google Dorking
  5. 1.5 Utilise tools like Maltego, theHarvester, and Shodan for information gathering
  6. 1.6 Analyse email header and metadata for intelligence gathering

2. Scan and Map the Network

  1. 2.1 Understand the purpose of network scanning for security, troubleshooting, and optimization
  2. 2.2 Differentiate between various types of scans
  3. 2.3 Use Nmap to discover live hosts, open ports, and services
  4. 2.4 Perform vulnerability scans
  5. 2.5 Interpret scan results to identify potential security gaps

3. Enumerate Target Resources

  1. 3.1 Enumerate Target Resources
  2. 3.2 Define enumeration and its role in cybersecurity and networking
  3. 3.3 Conduct enumeration
  4. 3.4 Perform LDAP and NetBIOS enumeration for directory services
  5. 3.5 Identify misconfigurations that could lead to privilege escalation

4. Exploit Known Vulnerabilities

  1. 4.1 Use Metasploit Framework to exploit system vulnerabilities
  2. 4.2 Demonstrate privilege escalation techniques on Windows and Linux based systems
  3. 4.3 Perform buffer overflow attacks and analyse the results
  4. 4.4 Execute web-based attacks

5. Perform Social Engineering

  1. 5.1 Define social engineering
  2. 5.2 Identify different types of social engineering attacks
  3. 5.3 Analyse case studies of real-world social engineering attacks
  4. 5.4 Conduct SET (Social-Engineer Toolkit)
  5. 5.5 Develop security awareness strategies to counter social engineering threats
  6. 5.6 Understand ethical configurations and legal aspects of social engineering test

6. Conduct System hacking

  1. 6.1 Explain the concept and objectives of system hacking in cybersecurity and IT system management
  2. 6.2 Demonstrate operating system exploitation techniques
  3. 6.3 Utilise password cracking tools
  4. 6.4 Analyse hacking tools and frameworks to assess system vulnerabilities
  5. 6.5 Deploy keylogging and spyware techniques to capture user credentials and monitor system activity
  6. 6.6 Execute pivoting techniques to move laterally within a compromised network and escalate access privileges
  7. 6.7 Apply methods for covering tracks
  8. 6.8 Implement system hacking countermeasures to mitigate threats
  9. 6.9 patch management

7. Prepare Security Assessment and Testing Report

  1. 7.1 Explain the significance of assessment and testing reports
  2. 7.2 Document vulnerabilities and their impact based on CVSS scores
  3. 7.3 Structure a professional security assessment report with findings and recommendations
  4. 7.4 Utilise automated reporting tools in assessment and testing
  5. 7.5 Develop remediation strategies based on industry best practice
  6. 7.6 Present security findings to technical and non-technical stakeholders

Practise this unit

The practical 76 The assessment itself: tools, materials and the marks Step-by-step guide 76 PPE, each step, what good looks like, common mistakes

Revise this unit

Past papers & answers 1 Real CDACC papers for this unit, free to download Exam-style questions 98 Written to CDACC standard, with answers Test yourself 272 Multiple-choice, one at a time Practise questions 230 Quick recall — check you know the facts
3 more for this unit
Oral exam preparation 63 What the assessor asks, and how to answer out loud Worked calculations 22 Step-by-step maths with the common mistakes Quick cards 1,317 Myth busters, skill tips and scenarios

Beyond the syllabus

Decision simulator 7 On site, what would you do? Workplace scenarios 140 Real site situations — what would you do? Turn this into income 84 Where this skill earns — what to charge, how to find clients

Other units in Module IV