CISSP Security Assessment and Testing Practice Test 2 — 15 Questions

Question 1

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 2

During a penetration test, the tester successfully exploits a vulnerability in a web server and gains initial access. The next step in the penetration testing process is to:

Accepted Answer

Conduct post-exploitation and lateral movement. After gaining initial access during a penetration test, the standard methodology (e.g., PTES, OWASP) requires conducting post-exploitation and lateral movement to assess the full impact of the compromise. This involves enumerating the compromised host, escalating privileges, and pivoting to other systems using techniques like pass-the-hash or SSH tunneling. Reporting findings immediately or disconnecting would violate the test scope and fail to demonstrate the real risk of the vulnerability.

Answer

Disconnect from the network

Answer

Report the findings immediately

Answer

Perform reconnaissance

Question 3

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). SAST (Static Application Security Testing) analyzes source code at rest, without executing it, making it ideal for finding vulnerabilities early in the development lifecycle.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 4

A company is preparing for an external audit to comply with PCI DSS. Which type of auditor is typically required to perform this assessment?

Accepted Answer

Qualified Security Assessor (QSA). PCI DSS requires assessments to be conducted by a Qualified Security Assessor (QSA) because QSAs are certified by the PCI Security Standards Council to validate compliance with the standard's technical and procedural controls. Unlike internal or general external auditors, QSAs have specific training in PCI DSS requirements, including network segmentation, encryption protocols (e.g., TLS 1.2+), and logging mechanisms (e.g., audit trails per Requirement 10).

Answer

System administrator

Answer

Internal auditor

Answer

Certified Public Accountant (CPA)

Question 5

Which of the following is the primary purpose of a security audit?

Accepted Answer

To compare security controls against a defined standard. A security audit's primary purpose is to systematically evaluate an organization's security controls against a predefined standard, such as ISO 27001, NIST SP 800-53, or PCI DSS. This comparison verifies compliance and identifies gaps, not merely vulnerabilities. Unlike a vulnerability assessment or penetration test, an audit focuses on adherence to criteria, not exploitation or informal review.

Answer

To identify vulnerabilities in the network

Answer

To perform an informal evaluation of security posture

Answer

To exploit vulnerabilities and demonstrate impact

Question 6

A security manager is reviewing metrics and sees that the "mean time to remediate" for critical vulnerabilities has increased over the past quarter. This metric is an example of a:

Accepted Answer

Key Performance Indicator (KPI). Mean time to remediate is a Key Performance Indicator (KPI) used to measure the effectiveness of vulnerability management processes.

Answer

Security baseline

Answer

Key Goal Indicator (KGI)

Answer

Key Risk Indicator (KRI)

Question 7

After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?

Accepted Answer

Reporting. The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.

Answer

Post-exploitation

Answer

Planning and scoping

Answer

Reconnaissance

Question 8

An organization wants to test its security controls by simulating an attack where the tester has no prior knowledge of the internal network. This is known as a:

Accepted Answer

Black box test. A black box test (D) is correct because the tester has no prior knowledge of the internal network, simulating an external attacker with zero inside information. This approach evaluates the security controls from an unprivileged, external perspective, relying solely on publicly available information and active reconnaissance. It is the purest form of adversarial simulation for testing perimeter defenses and detection capabilities.

Answer

Grey box test

Answer

White box test

Answer

Red team exercise

Question 9

A company is required to retain logs for regulatory compliance. Which factor primarily determines the log retention period?

Accepted Answer

Regulatory requirements. Regulatory compliance frameworks (e.g., PCI DSS, HIPAA, SOX, GDPR) explicitly mandate minimum log retention periods (e.g., PCI DSS Requirement 10.7 requires at least one year of logs, with three months immediately accessible). Storage capacity, incident response needs, and log volume are operational considerations that may influence implementation but do not override the legal or contractual obligation to retain logs for a specified duration. The primary factor is the regulatory requirement itself, as failure to comply can result in fines, legal liability, or loss of certification.

Answer

Storage capacity

Answer

Incident response needs

Answer

Log volume

Question 10

During a SOC 2 audit, the auditor evaluates controls over a period of time to assess their operating effectiveness. Which type of SOC report is being performed?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports assess the operating effectiveness of controls over a period of time, while Type I reports are at a point in time.

Answer

SOC 1 Type I

Answer

SOC 3

Answer

SOC 2 Type I

Question 11

A vulnerability scanner reports a vulnerability with a CVSS score of 9.8. What does this score indicate?

Accepted Answer

Critical severity. A CVSS score of 9.8 falls within the range of 9.0–10.0, which is classified as 'Critical' severity according to the CVSS v3.1 specification. This score typically indicates a vulnerability that can be exploited remotely without authentication and with low attack complexity, often leading to complete compromise of confidentiality, integrity, and availability.

Answer

High severity

Answer

Medium severity

Answer

Low severity

Question 12

Which of the following is a key element of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Rules of engagement must include written authorization and define the scope, including systems to be tested and emergency stop criteria.

Answer

The tester's compensation

Answer

The tester's background check

Answer

The number of vulnerabilities to find

Question 13

A security analyst is reviewing logs from multiple systems in a centralized log management platform. Which TWO of the following are primary benefits of centralized log management?

Accepted Answer

Simplifies compliance with log retention requirements. Centralized log management facilitates correlation across systems and simplifies compliance by providing a single source for log retention and review.

Answer

Eliminates the need for log retention policies

Answer

Reduces the volume of logs generated

Answer

Automatically patches vulnerabilities

Question 14

A company is planning to conduct a penetration test. Which THREE of the following should be included in the rules of engagement?

Accepted Answer

Emergency stop criteria. Option B is correct because emergency stop criteria define the conditions under which the penetration test must be immediately halted, such as causing a production system outage or detecting unauthorized data access. This is a critical component of the rules of engagement (RoE) to ensure the test does not cause unacceptable business impact, aligning with the principle of minimizing risk during security assessments.

Answer

The tester's personal contact information

Answer

Specific vulnerabilities to be exploited

Question 15

An organization wants to assess the security of its custom web application. Which TWO of the following are types of code review that can be used to identify vulnerabilities?

Accepted Answer

Static Application Security Testing (SAST). SAST analyzes source code without execution, while DAST tests the running application. Both are common code review techniques for web applications.

Answer

Physical security assessment

Answer

Social engineering

Answer

Network penetration testing