CISSP Security Assessment and Testing Practice Test 2 — 15 Questions

Question 1

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 2

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 3

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 4

During a penetration test, the tester successfully exploits a vulnerability in a web server and gains initial access. The next step in the penetration testing process is to:

Accepted Answer

Conduct post-exploitation and lateral movement. After gaining initial access during a penetration test, the standard methodology (e.g., PTES, OWASP) requires conducting post-exploitation and lateral movement to assess the full impact of the compromise. This involves enumerating the compromised host, escalating privileges, and pivoting to other systems using techniques like pass-the-hash or SSH tunneling. Reporting findings immediately or disconnecting would violate the test scope and fail to demonstrate the real risk of the vulnerability.

Answer

Disconnect from the network

Answer

Report the findings immediately

Answer

Perform reconnaissance

Question 5

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it the only option that matches the requirement of reviewing code for vulnerabilities in a non-running state. SAST tools perform data-flow and control-flow analysis to detect issues like SQL injection, buffer overflows, and hardcoded secrets directly in the codebase. Because it operates pre-execution, it can be integrated early in the SDLC (shift-left) and pinpoint the exact file and line of a flaw.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 6

A company is preparing for an external audit to comply with PCI DSS. Which type of auditor is typically required to perform this assessment?

Accepted Answer

Qualified Security Assessor (QSA). PCI DSS requires assessments to be conducted by a Qualified Security Assessor (QSA) because QSAs are certified by the PCI Security Standards Council to validate compliance with the standard's technical and procedural controls. Unlike internal or general external auditors, QSAs have specific training in PCI DSS requirements, including network segmentation, encryption protocols (e.g., TLS 1.2+), and logging mechanisms (e.g., audit trails per Requirement 10).

Answer

System administrator

Answer

Internal auditor

Answer

Certified Public Accountant (CPA)

Question 7

Which of the following is the primary purpose of a security audit?

Accepted Answer

To compare security controls against a defined standard. A security audit's primary purpose is to systematically evaluate an organization's security controls against a predefined standard, such as ISO 27001, NIST SP 800-53, or PCI DSS. This comparison verifies compliance and identifies gaps, not merely vulnerabilities. Unlike a vulnerability assessment or penetration test, an audit focuses on adherence to criteria, not exploitation or informal review.

Answer

To identify vulnerabilities in the network

Answer

To perform an informal evaluation of security posture

Answer

To exploit vulnerabilities and demonstrate impact

Question 8

A security manager is reviewing metrics and sees that the "mean time to remediate" for critical vulnerabilities has increased over the past quarter. This metric is an example of a:

Accepted Answer

Key Performance Indicator (KPI). Mean time to remediate (MTTR) for critical vulnerabilities measures how efficiently the security team is performing remediation, making it a Key Performance Indicator (KPI). KPIs track the performance of processes and activities against operational targets.

Answer

Security baseline

Answer

Key Goal Indicator (KGI)

Answer

Key Risk Indicator (KRI)

Question 9

After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?

Accepted Answer

Reporting. The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.

Answer

Post-exploitation

Answer

Planning and scoping

Answer

Reconnaissance

Question 10

An organization wants to test its security controls by simulating an attack where the tester has no prior knowledge of the internal network. This is known as a:

Accepted Answer

Black box test. A black box test (D) is correct because the tester has no prior knowledge of the internal network, simulating an external attacker with zero inside information. This approach evaluates the security controls from an unprivileged, external perspective, relying solely on publicly available information and active reconnaissance. It is the purest form of adversarial simulation for testing perimeter defenses and detection capabilities.

Answer

Grey box test

Answer

White box test

Answer

Red team exercise

Question 11

A company is required to retain logs for regulatory compliance. Which factor primarily determines the log retention period?

Accepted Answer

Regulatory requirements. Regulatory compliance frameworks (e.g., PCI DSS, HIPAA, SOX, GDPR) explicitly mandate minimum log retention periods (e.g., PCI DSS Requirement 10.7 requires at least one year of logs, with three months immediately accessible). Storage capacity, incident response needs, and log volume are operational considerations that may influence implementation but do not override the legal or contractual obligation to retain logs for a specified duration. The primary factor is the regulatory requirement itself, as failure to comply can result in fines, legal liability, or loss of certification.

Answer

Storage capacity

Answer

Incident response needs

Answer

Log volume

Question 12

During a SOC 2 audit, the auditor evaluates controls over a period of time to assess their operating effectiveness. Which type of SOC report is being performed?

Accepted Answer

SOC 2 Type II. A SOC 2 Type II report evaluates the operating effectiveness of controls over a period of time (typically 3–12 months), which is exactly what the auditor is doing here. Type II includes testing of control activities across the audit period, unlike Type I which only assesses design at a point in time.

Answer

SOC 1 Type I

Answer

SOC 3

Answer

SOC 2 Type I

Question 13

A vulnerability scanner reports a vulnerability with a CVSS score of 9.8. What does this score indicate?

Accepted Answer

Critical severity. A CVSS score of 9.8 falls within the range of 9.0–10.0, which is classified as 'Critical' severity according to the CVSS v3.1 specification. This score typically indicates a vulnerability that can be exploited remotely without authentication and with low attack complexity, often leading to complete compromise of confidentiality, integrity, and availability.

Answer

High severity

Answer

Medium severity

Answer

Low severity

Question 14

Which of the following is a key element of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Emergency stop criteria is correct because rules of engagement (RoE) must define the conditions under which testing halts immediately — for example, discovery of a live production outage, unintended data exfiltration, or a critical system failure — so the client can protect business continuity and the tester has legal cover to stop. RoE is a governance document that scopes authorization, timing, targets, and abort conditions, and the stop criteria are its most safety-critical clause. Without explicit halt conditions, a tester could inadvertently cause an outage with no agreed protocol for disengagement.

Answer

The tester's compensation

Answer

The tester's background check

Answer

The number of vulnerabilities to find

Question 15

A security analyst is reviewing logs from multiple systems in a centralized log management platform. Which TWO of the following are primary benefits of centralized log management?

Accepted Answer

Simplifies compliance with log retention requirements. Option A is correct because a centralized log management platform applies uniform retention settings and storage policies across all ingested sources, which directly simplifies demonstrating compliance with regulatory log retention requirements (e.g., PCI DSS 10.7, HIPAA, SOX). Option B is correct because aggregating logs from multiple systems into one platform allows the SIEM/log manager to correlate events across hosts, applications, and network devices, enabling detection of multi-stage or distributed attacks that would be invisible in isolated logs. Option C is wrong because centralization does not remove the need for retention policies; it actually requires well-defined retention rules to manage storage and compliance. Option D is wrong because centralization aggregates and stores logs, typically increasing rather than reducing total log volume, though it may improve analysis efficiency. Option E is wrong because log management platforms collect and analyze logs; they do not automatically patch vulnerabilities, which is the role of patch management or vulnerability management tools.

Answer

Eliminates the need for log retention policies

Answer

Reduces the volume of logs generated

Answer

Automatically patches vulnerabilities