When the person or team testing the system has knowledge of and possibly…

The idea

This statement describes a penetration test carried out from an insider position. The tester already knows something about the target system and may hold basic credentials, such as a standard user login, so the test begins partway inside rather than at the outer boundary. The aim is to simulate a malicious insider: someone with legitimate access who abuses it. The tester uses that knowledge and access to see how far an insider could reach, for example whether a standard account can read files it should not, escalate privileges or reach sensitive data. Because the tester starts with access, this tests internal controls such as permissions, monitoring and segregation of duties rather than perimeter defences. Recognise the key signals: prior knowledge, possible basic credentials, attack simulated from inside, malicious insider.

What earns the marks

• Identifies that the tester already has knowledge of the target system.
• Recognises that the tester may hold basic credentials for the target system.
• States that the attack is simulated from inside the system.
• Links the scenario to the idea of a malicious insider abusing legitimate access.
• Distinguishes this insider test from an external test where no credentials are known.

Common mistakes and how to put them right

• Confusing this with an external attack.

  Put it right: The tester here starts with knowledge and possibly credentials, so the simulation is from inside.

• Assuming the tester has full administrator rights.

  Put it right: The credentials are only possibly basic, so the test explores what a limited insider could do.

• Treating it as a real attack by a criminal.

  Put it right: It is an authorised test simulating a malicious insider.

Exam tips

• Look for the words knowledge, credentials and inside in the option before choosing it.
• Reject any option describing a tester with no knowledge of the system, as that describes an external attack.
• Link the scenario to the term malicious insider to confirm the match.