CISSP Security Assessment and Testing — 30 Questions

Question 1

A security auditor is assessing whether a company's controls comply with ISO 27001. What type of audit is being conducted?

Accepted Answer

External audit. An external audit is conducted by an independent third party (such as a certification body) to assess compliance with a standard like ISO 27001 for certification purposes. To make this option unambiguously correct, the stem must specify that the audit is being performed by an independent, external third party.

Answer

Penetration test

Answer

SOC 2 Type II audit

Answer

Internal audit

Question 2

During a security audit, the auditor selects a sample of user access reviews to verify that access rights are properly managed. This type of testing is best described as:

Accepted Answer

Security audit. By starting the stem with 'During a security audit...', the question gives away the correct answer ('Security audit'). Rewording the stem to refer to 'An independent third party' removes this circularity while keeping the question's core concept intact.

Answer

Vulnerability assessment

Answer

Penetration test

Answer

Security review

Question 3

An organization wants to assess the security of its custom web application. Which TWO of the following are types of code review that can be used to identify vulnerabilities?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) are two primary application security testing (AST) methods. SAST (white-box) analyzes the application's source code or binaries for vulnerabilities without executing the program. DAST (black-box) analyzes the running application from the outside to find vulnerabilities. While SAST is a form of automated code review, DAST is not.

Answer

Physical security assessment

Answer

Social engineering

Answer

Network penetration testing

Question 4

Which vulnerability scoring system is commonly used to assess the severity of vulnerabilities?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) is the industry-standard framework for assigning a numerical severity score (0–10) to a vulnerability based on metrics like attack vector, complexity, privileges required, and impact. It is maintained by the Forum of Incident Response and Security Teams (FIRST) and is widely adopted by organizations for prioritization in vulnerability management. CVSS provides a consistent, quantitative measure that allows security teams to compare and triage vulnerabilities across different systems and vendors.

Answer

NVD

Answer

CVE

Answer

OWASP

Question 5

A security analyst is setting up a vulnerability scanning program. Which TWO of the following are best practices for determining scanning frequency?

Accepted Answer

Scan after significant changes to the infrastructure. Determining vulnerability scanning frequency should be driven by both event-based triggers and risk-based strategies. Scanning after significant infrastructure changes (Option B) ensures that new deployments, configuration modifications, or patches have not introduced new vulnerabilities. Aligning scan frequency with the organization's risk appetite (Option C) ensures that high-value or high-risk assets are scanned more frequently (e.g., weekly or daily) while lower-risk assets can be scanned less frequently, optimizing resource allocation and risk management.

Answer

Scan once per year to minimize operational impact

Answer

Scan only when vulnerabilities are publicly disclosed

Answer

Use the same interval for all systems regardless of criticality

Question 6

An organization is reviewing its log management practices. Which THREE of the following are key considerations for effective log review?

Accepted Answer

Log retention policies that comply with legal and regulatory requirements. Effective log management and review require a proactive, structured, and secure approach:

- **Log retention policies (B)** ensure that logs are preserved long enough to satisfy legal, regulatory, and forensic requirements.
- **Regularly scheduled reviews (D)** allow organizations to detect anomalies and potential security incidents proactively, rather than just reacting after a breach.
- **Centralized log management (E)** is critical for aggregating logs from diverse sources and correlating events to identify complex attack patterns.

Conversely, reviewing logs only after an incident (A) is purely reactive and misses the opportunity for early detection. Storing logs in plaintext without access controls (C) exposes sensitive audit data to unauthorized modification or disclosure, compromising log integrity.

Answer

Reviewing logs only after a security incident

Answer

Storing logs in plaintext without access controls

Question 7

A security analyst is asked to identify vulnerabilities in a web application without attempting to exploit them. Which type of assessment is being performed?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is a systematic review of security weaknesses in a system or application, but it does not involve actively exploiting those weaknesses. The question specifies that the analyst is asked to identify vulnerabilities without attempting to exploit them, which directly matches the definition of a vulnerability assessment. This type of assessment typically uses automated scanners (e.g., Nessus, OpenVAS) and manual checks to enumerate potential vulnerabilities, such as missing patches or misconfigurations, without moving to the exploitation phase.

Answer

Security review

Answer

Security audit

Answer

Penetration test

Question 8

During a penetration test, the tester has obtained initial access and is now trying to move laterally to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. The post-exploitation/lateral movement phase occurs after initial access is gained, where the tester uses compromised systems as pivot points to access other network segments, often leveraging tools like PsExec, WMI, or SMB relay to move across hosts. This phase is distinct from exploitation, which focuses on gaining the initial foothold, and reconnaissance, which occurs before any access is obtained.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 9

A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code in a non-runtime environment, identifying vulnerabilities early in the SDLC.

Answer

IAST

Answer

RASP

Answer

DAST

Question 10

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Rules of engagement must include written authorization, scope definition, and emergency stop criteria to ensure legal and safe testing.

Answer

Exploitation techniques to use

Answer

CVSS score of vulnerabilities

Answer

Number of vulnerabilities found

Question 11

Which vulnerability scoring system provides a standardized severity rating for vulnerabilities based on exploitability and impact metrics?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) provides a standardized, quantitative framework for rating the severity of security vulnerabilities. It calculates a score from 0.0 to 10.0 based on exploitability metrics (e.g., attack vector, complexity, privileges required) and impact metrics (e.g., confidentiality, integrity, availability), enabling organizations to prioritize remediation efforts consistently.

Answer

NVD

Answer

CVE

Answer

CWE

Question 12

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) for critical vulnerabilities directly measures the speed of response, which is a key indicator of program effectiveness.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 13

Which type of SOC report provides a public summary of an organization's controls over security, availability, and confidentiality?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and summarize the findings of a SOC 2 engagement.

Answer

SOC 2 Type II

Answer

SOC 1

Answer

SOC 2 Type I

Question 14

An organization is required to retain security logs for a minimum of one year to meet compliance regulations. Which practice is most directly related to this requirement?

Accepted Answer

Log retention requirements. The requirement to retain security logs for a minimum of one year is directly about the duration logs must be stored. Option D, 'Log retention requirements,' is the practice that defines this storage duration, ensuring compliance with regulations such as PCI DSS or SOX. This is a policy-driven specification of how long logs are kept, not how they are reviewed, formatted, or collected.

Answer

Log review frequency

Answer

Log format standardization

Answer

Centralized log management

Question 15

Which type of scanning provides the most comprehensive view of an organization's vulnerabilities by allowing the scanner to log into systems and access detailed configuration information?

Accepted Answer

Authenticated scan. Authenticated scans use credentials to access system internals, providing deeper insight than unauthenticated scans.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 16

A company hires a third party to perform an assessment where the testers are given no prior knowledge of the internal network. This type of penetration test is known as:

Accepted Answer

Black box. A black box penetration test simulates an external attacker with no prior knowledge of the target environment. The testers are given no credentials, network diagrams, or internal details, forcing them to perform reconnaissance and exploitation from an outsider's perspective. This aligns directly with the scenario where the third party has 'no prior knowledge of the internal network.'

Answer

White box

Answer

Grey box

Answer

Internal test

Question 17

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 18

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 19

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems

Question 20

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan