CISSP Security Assessment and Testing Practice Test 2 — 15 Questions

Question 1

A company hires a third party to perform an assessment where the testers are given no prior knowledge of the internal network. This type of penetration test is known as:

Accepted Answer

Black box. A black box penetration test simulates an external attacker with no prior knowledge of the target environment. The testers are given no credentials, network diagrams, or internal details, forcing them to perform reconnaissance and exploitation from an outsider's perspective. This aligns directly with the scenario where the third party has 'no prior knowledge of the internal network.'

Answer

White box

Answer

Grey box

Answer

Internal test

Question 2

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 3

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 4

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems

Question 5

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 6

During a penetration test, the tester successfully exploits a vulnerability in a web server and gains initial access. The next step in the penetration testing process is to:

Accepted Answer

Conduct post-exploitation and lateral movement. After gaining initial access during a penetration test, the standard methodology (e.g., PTES, OWASP) requires conducting post-exploitation and lateral movement to assess the full impact of the compromise. This involves enumerating the compromised host, escalating privileges, and pivoting to other systems using techniques like pass-the-hash or SSH tunneling. Reporting findings immediately or disconnecting would violate the test scope and fail to demonstrate the real risk of the vulnerability.

Answer

Disconnect from the network

Answer

Report the findings immediately

Answer

Perform reconnaissance

Question 7

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). SAST (Static Application Security Testing) analyzes source code at rest, without executing it, making it ideal for finding vulnerabilities early in the development lifecycle.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 8

A company is preparing for an external audit to comply with PCI DSS. Which type of auditor is typically required to perform this assessment?

Accepted Answer

Qualified Security Assessor (QSA). PCI DSS requires assessments to be conducted by a Qualified Security Assessor (QSA) because QSAs are certified by the PCI Security Standards Council to validate compliance with the standard's technical and procedural controls. Unlike internal or general external auditors, QSAs have specific training in PCI DSS requirements, including network segmentation, encryption protocols (e.g., TLS 1.2+), and logging mechanisms (e.g., audit trails per Requirement 10).

Answer

System administrator

Answer

Internal auditor

Answer

Certified Public Accountant (CPA)

Question 9

Which of the following is the primary purpose of a security audit?

Accepted Answer

To compare security controls against a defined standard. A security audit's primary purpose is to systematically evaluate an organization's security controls against a predefined standard, such as ISO 27001, NIST SP 800-53, or PCI DSS. This comparison verifies compliance and identifies gaps, not merely vulnerabilities. Unlike a vulnerability assessment or penetration test, an audit focuses on adherence to criteria, not exploitation or informal review.

Answer

To identify vulnerabilities in the network

Answer

To perform an informal evaluation of security posture

Answer

To exploit vulnerabilities and demonstrate impact

Question 10

A security manager is reviewing metrics and sees that the "mean time to remediate" for critical vulnerabilities has increased over the past quarter. This metric is an example of a:

Accepted Answer

Key Performance Indicator (KPI). Mean time to remediate is a Key Performance Indicator (KPI) used to measure the effectiveness of vulnerability management processes.

Answer

Security baseline

Answer

Key Goal Indicator (KGI)

Answer

Key Risk Indicator (KRI)

Question 11

After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?

Accepted Answer

Reporting. The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.

Answer

Post-exploitation

Answer

Planning and scoping

Answer

Reconnaissance

Question 12

An organization wants to test its security controls by simulating an attack where the tester has no prior knowledge of the internal network. This is known as a:

Accepted Answer

Black box test. A black box test (D) is correct because the tester has no prior knowledge of the internal network, simulating an external attacker with zero inside information. This approach evaluates the security controls from an unprivileged, external perspective, relying solely on publicly available information and active reconnaissance. It is the purest form of adversarial simulation for testing perimeter defenses and detection capabilities.

Answer

Grey box test

Answer

White box test

Answer

Red team exercise

Question 13

A company is required to retain logs for regulatory compliance. Which factor primarily determines the log retention period?

Accepted Answer

Regulatory requirements. Regulatory compliance frameworks (e.g., PCI DSS, HIPAA, SOX, GDPR) explicitly mandate minimum log retention periods (e.g., PCI DSS Requirement 10.7 requires at least one year of logs, with three months immediately accessible). Storage capacity, incident response needs, and log volume are operational considerations that may influence implementation but do not override the legal or contractual obligation to retain logs for a specified duration. The primary factor is the regulatory requirement itself, as failure to comply can result in fines, legal liability, or loss of certification.

Answer

Storage capacity

Answer

Incident response needs

Answer

Log volume

Question 14

During a SOC 2 audit, the auditor evaluates controls over a period of time to assess their operating effectiveness. Which type of SOC report is being performed?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports assess the operating effectiveness of controls over a period of time, while Type I reports are at a point in time.

Answer

SOC 1 Type I

Answer

SOC 3

Answer

SOC 2 Type I

Question 15

A vulnerability scanner reports a vulnerability with a CVSS score of 9.8. What does this score indicate?

Accepted Answer

Critical severity. A CVSS score of 9.8 falls within the range of 9.0–10.0, which is classified as 'Critical' severity according to the CVSS v3.1 specification. This score typically indicates a vulnerability that can be exploited remotely without authentication and with low attack complexity, often leading to complete compromise of confidentiality, integrity, and availability.

Answer

High severity

Answer

Medium severity

Answer

Low severity