CISSP Security Assessment and Testing Practice Test 3 — 15 Questions

Question 1

A company is planning to conduct a penetration test. Which THREE of the following should be included in the rules of engagement?

Accepted Answer

Emergency stop criteria. Emergency stop criteria define the conditions under which the penetration test must be immediately halted, such as causing a production system outage or detecting unauthorized data access. This is a critical component of the rules of engagement (RoE) to ensure the test does not cause unacceptable business impact, aligning with the principle of minimizing risk during security assessments.

Answer

The tester's personal contact information

Answer

Specific vulnerabilities to be exploited

Question 2

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 3

During a penetration testing engagement, which TWO of the following are essential components of the rules of engagement document?

Accepted Answer

Emergency stop criteria. In penetration testing, the rules of engagement (ROE) document defines the operational parameters, including emergency stop criteria (Option B) and scope definition (Option D). Written authorization from management (Option E) is a separate prerequisite document granting legal permission to test; it is not part of the ROE. Vulnerability severity ratings (Option A) are found in the final report, and detailed exploit code (Option C) is a technical artifact not included in the ROE.

Answer

Vulnerability severity ratings

Answer

Detailed exploit code

Answer

Written authorization from management

Question 4

A security analyst is reviewing logs from multiple systems and needs to ensure that logs are tamper-proof and available for incident investigation. Which of the following is the BEST approach?

Accepted Answer

Centralize logs to a syslog server with cryptographic hashing and append-only access. It combines three essential log-security controls: centralization (so logs survive compromise of individual hosts), cryptographic hashing (which provides integrity verification and detects tampering), and append-only access (which prevents attackers or insiders from deleting or altering existing records). Centralizing to a syslog server also supports availability for incident investigation, since logs are not lost if a source system is wiped. Together, these controls directly satisfy the requirement for tamper-proof, investigation-ready logs.

Answer

Use a cloud storage bucket with public read access

Answer

Store logs locally on each system with restricted permissions

Answer

Encrypt logs at the source and send via email to the security team

Question 5

Which TWO of the following are characteristics of a SOC 2 Type II report?

Accepted Answer

Covers the design and operating effectiveness of controls over a period of time. Option A is correct because a SOC 2 Type II report specifically tests both the design and the operating effectiveness of controls throughout a defined review period (typically 3–12 months), unlike a Type I report which only assesses design at a point in time. Option C is correct because SOC 2 engagements are structured around the AICPA Trust Services Criteria, which include security (required) plus availability, processing integrity, confidentiality, and privacy as optional categories. Option B is incorrect because SOC 2 reports are restricted-use reports distributed under NDA to management, customers, and auditors—not public documents (that role belongs to SOC 3). Option D is incorrect because financial reporting controls are the focus of SOC 1 (SSAE 18/ISAE 3402), not SOC 2. Option E is incorrect because point-in-time evaluation describes a SOC 2 Type I report, whereas Type II covers a period.

Answer

Is a public summary report available to anyone

Answer

Focuses only on financial reporting controls

Answer

Evaluates controls at a single point in time

Question 6

A company must comply with a regulation requiring a formal, independent assessment of its security controls against a standard. Which type of assessment is MOST appropriate?

Accepted Answer

Security audit. A security audit is the most appropriate assessment because it is a formal, independent evaluation of an organization's security controls against a predefined standard (e.g., ISO 27001, NIST SP 800-53). Unlike other assessments, an audit is conducted by an independent third party or internal audit function, providing objective evidence of compliance with regulatory requirements.

Answer

Penetration test

Answer

Security review

Answer

Vulnerability assessment

Question 7

A developer uses a tool that analyzes source code for potential security flaws without executing the program. This is an example of:

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. This matches the description of a tool that inspects code statically, making D the correct answer.

Answer

DAST

Answer

IAST

Answer

RASP

Question 8

Which THREE of the following are common key performance indicators (KPIs) used in security assessment and testing?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate critical vulnerabilities (A) is a core security-assessment KPI because it measures how quickly the organization closes high-risk findings, directly reflecting the effectiveness of its vulnerability management process. Patch compliance percentage (B) is also a standard KPI, quantifying the proportion of systems that have current patches applied and thus indicating exposure to known exploits. Open vulnerability count by severity (D) is a common KPI that tracks the outstanding backlog of vulnerabilities grouped by critical, high, medium, and low, giving a snapshot of residual risk and remediation workload. The other options are not typical security-assessment KPIs: the number of employees trained on security awareness (C) is a training/awareness metric rather than a measure of assessment or testing outcomes, and the number of help desk tickets (E) is an IT service management volume metric unrelated to security testing performance.

Answer

Number of employees trained on security awareness

Answer

Number of help desk tickets

Question 9

An organization is preparing for an ISO 27001 certification audit. The audit will be performed by an external body. This type of audit is classified as:

Accepted Answer

External audit. An external audit is performed by an independent third-party organization, such as a certification body, to assess compliance against a standard like ISO 27001. In this scenario, the audit is conducted by an external body specifically for certification purposes, which directly matches the definition of an external audit. This type of audit provides an unbiased evaluation of the Information Security Management System (ISMS) and is required for formal certification.

Answer

Self-assessment

Answer

Peer review

Answer

Internal audit

Question 10

During a penetration test, the tester successfully gains access to a server and then attempts to move laterally to other systems. This phase is known as:

Accepted Answer

Post-exploitation and lateral movement. After initial access is gained, the phase where the tester moves from the compromised host to other systems within the network is specifically called post-exploitation and lateral movement. This involves using the foothold to pivot, escalate privileges, and access additional resources, which is distinct from the initial exploitation step.

Answer

Scanning and enumeration

Answer

Exploitation

Answer

Reconnaissance

Question 11

Which TWO of the following are benefits of authenticated vulnerability scanning compared to unauthenticated scanning?

Accepted Answer

Can detect vulnerabilities that require valid credentials to be seen. Option A is correct because authenticated scanning logs into the target host with valid credentials, allowing the scanner to inspect local files, registry keys, installed packages, and configuration settings that are invisible to an unauthenticated scan, thereby detecting vulnerabilities that require credentials to be seen. Option D is correct because credentialed access lets the scanner read exact software versions, patch levels, and update history directly from the host, yielding more accurate patch-level information than remote banner grabbing or version inference. Option B is not correct because authenticated scans typically generate more traffic, not less, since they perform deeper enumeration and local checks. Option C is not correct because no scanning method eliminates false positives entirely; authentication reduces but does not remove them. Option E is not correct because authenticated scans still require network access to reach and log into the target host.

Answer

Reduces network traffic

Answer

Eliminates false positives entirely

Answer

Does not require network access

Question 12

An organization wants to test its web application for vulnerabilities by running the application and probing it with malicious inputs. Which tool is BEST suited for this purpose?

Accepted Answer

OWASP ZAP. OWASP ZAP (Zed Attack Proxy) is a dynamic application security testing (DAST) tool that runs the application and actively probes it with malicious inputs, making it the correct choice for runtime vulnerability testing. It intercepts and modifies HTTP/S traffic, performs active scanning for injection, XSS, and misconfigurations, and is specifically designed for testing running web applications.

Answer

Checkmarx

Answer

SonarQube

Answer

Veracode

Question 13

A company's security team uses a tool that instruments the application at runtime to monitor and block attacks. This is an example of:

Accepted Answer

RASP. RASP (Runtime Application Self-Protection) instruments the application at runtime, embedding security checks inside the application to detect and block attacks in real time. It operates within the application's execution context, allowing it to monitor data flow, method calls, and user input.

Answer

IAST

Answer

SAST

Answer

DAST

Question 14

Which vulnerability scoring system is commonly used to assess the severity of vulnerabilities?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) is the industry-standard framework for assigning a numerical severity score (0–10) to a vulnerability based on metrics like attack vector, complexity, privileges required, and impact. It is maintained by the Forum of Incident Response and Security Teams (FIRST) and is widely adopted by organizations for prioritization in vulnerability management. CVSS provides a consistent, quantitative measure that allows security teams to compare and triage vulnerabilities across different systems and vendors.

Answer

NVD

Answer

CVE

Answer

OWASP

Question 15

An organization requires a security assessment that evaluates controls against a specific standard and results in a formal report. The organization is not required to exploit vulnerabilities. Which type of assessment is this?

Accepted Answer

Security audit. A security audit is a formal, independent evaluation of controls against a predefined standard (e.g., ISO 27001, PCI DSS) that produces a formal report. Unlike other assessments, it does not require exploiting vulnerabilities; it focuses on verifying compliance through evidence collection and testing. This matches the question's requirement for a standard-based evaluation with a formal report and no exploitation.

Answer

Vulnerability assessment

Answer

Penetration test

Answer

Security review