CISSP Security Assessment and Testing — Timed 25 Questions

Question 1

A security analyst is asked to identify vulnerabilities in a web application without attempting to exploit them. Which type of assessment is being performed?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is a systematic review of security weaknesses in a system or application, but it does not involve actively exploiting those weaknesses. The question specifies that the analyst is asked to identify vulnerabilities without attempting to exploit them, which directly matches the definition of a vulnerability assessment. This type of assessment typically uses automated scanners (e.g., Nessus, OpenVAS) and manual checks to enumerate potential vulnerabilities, such as missing patches or misconfigurations, without moving to the exploitation phase.

Answer

Security review

Answer

Security audit

Answer

Penetration test

Question 2

During a penetration test, the tester has obtained initial access and is now trying to move laterally to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. The post-exploitation/lateral movement phase occurs after initial access is gained, where the tester uses compromised systems as pivot points to access other network segments, often leveraging tools like PsExec, WMI, or SMB relay to move across hosts. This phase is distinct from exploitation, which focuses on gaining the initial foothold, and reconnaissance, which occurs before any access is obtained.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 3

A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code in a non-runtime environment, identifying vulnerabilities early in the SDLC.

Answer

IAST

Answer

RASP

Answer

DAST

Question 4

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Rules of engagement must include written authorization, scope definition, and emergency stop criteria to ensure legal and safe testing.

Answer

Exploitation techniques to use

Answer

CVSS score of vulnerabilities

Answer

Number of vulnerabilities found

Question 5

A security auditor is assessing whether a company's controls comply with ISO 27001. What type of audit is being conducted?

Accepted Answer

External audit. An external audit is conducted by an independent third party to assess compliance with a standard like ISO 27001. This type of audit provides an unbiased evaluation of whether the organization's controls meet the specified requirements, which is essential for certification purposes. The auditor is not an employee of the organization, ensuring objectivity and credibility in the assessment.

Answer

Penetration test

Answer

SOC 2 Type II audit

Answer

Internal audit

Question 6

Which vulnerability scoring system provides a standardized severity rating for vulnerabilities based on exploitability and impact metrics?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) provides a standardized, quantitative framework for rating the severity of security vulnerabilities. It calculates a score from 0.0 to 10.0 based on exploitability metrics (e.g., attack vector, complexity, privileges required) and impact metrics (e.g., confidentiality, integrity, availability), enabling organizations to prioritize remediation efforts consistently.

Answer

NVD

Answer

CVE

Answer

CWE

Question 7

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) for critical vulnerabilities directly measures the speed of response, which is a key indicator of program effectiveness.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 8

Which type of SOC report provides a public summary of an organization's controls over security, availability, and confidentiality?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and summarize the findings of a SOC 2 engagement.

Answer

SOC 2 Type II

Answer

SOC 1

Answer

SOC 2 Type I

Question 9

An organization is required to retain security logs for a minimum of one year to meet compliance regulations. Which practice is most directly related to this requirement?

Accepted Answer

Log retention requirements. The requirement to retain security logs for a minimum of one year is directly about the duration logs must be stored. Option D, 'Log retention requirements,' is the practice that defines this storage duration, ensuring compliance with regulations such as PCI DSS or SOX. This is a policy-driven specification of how long logs are kept, not how they are reviewed, formatted, or collected.

Answer

Log review frequency

Answer

Log format standardization

Answer

Centralized log management

Question 10

During a security audit, the auditor selects a sample of user access reviews to verify that access rights are properly managed. This type of testing is best described as:

Accepted Answer

Security audit. A security audit is a formal, independent examination of records and activities to verify that controls are effective and compliant with policies. In this scenario, the auditor's sampling of user access reviews to confirm proper access rights management is a classic audit procedure, not a technical vulnerability scan or an active exploitation attempt. This aligns with the definition of a security audit as a systematic evaluation of security controls.

Answer

Vulnerability assessment

Answer

Penetration test

Answer

Security review

Question 11

Which type of scanning provides the most comprehensive view of an organization's vulnerabilities by allowing the scanner to log into systems and access detailed configuration information?

Accepted Answer

Authenticated scan. Authenticated scans use credentials to access system internals, providing deeper insight than unauthenticated scans.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 12

A company hires a third party to perform an assessment where the testers are given no prior knowledge of the internal network. This type of penetration test is known as:

Accepted Answer

Black box. A black box penetration test simulates an external attacker with no prior knowledge of the target environment. The testers are given no credentials, network diagrams, or internal details, forcing them to perform reconnaissance and exploitation from an outsider's perspective. This aligns directly with the scenario where the third party has 'no prior knowledge of the internal network.'

Answer

White box

Answer

Grey box

Answer

Internal test

Question 13

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 14

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 15

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems

Question 16

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 17

During a penetration test, the tester successfully exploits a vulnerability in a web server and gains initial access. The next step in the penetration testing process is to:

Accepted Answer

Conduct post-exploitation and lateral movement. After gaining initial access during a penetration test, the standard methodology (e.g., PTES, OWASP) requires conducting post-exploitation and lateral movement to assess the full impact of the compromise. This involves enumerating the compromised host, escalating privileges, and pivoting to other systems using techniques like pass-the-hash or SSH tunneling. Reporting findings immediately or disconnecting would violate the test scope and fail to demonstrate the real risk of the vulnerability.

Answer

Disconnect from the network

Answer

Report the findings immediately

Answer

Perform reconnaissance

Question 18

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). SAST (Static Application Security Testing) analyzes source code at rest, without executing it, making it ideal for finding vulnerabilities early in the development lifecycle.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 19

A company is preparing for an external audit to comply with PCI DSS. Which type of auditor is typically required to perform this assessment?

Accepted Answer

Qualified Security Assessor (QSA). PCI DSS requires assessments to be conducted by a Qualified Security Assessor (QSA) because QSAs are certified by the PCI Security Standards Council to validate compliance with the standard's technical and procedural controls. Unlike internal or general external auditors, QSAs have specific training in PCI DSS requirements, including network segmentation, encryption protocols (e.g., TLS 1.2+), and logging mechanisms (e.g., audit trails per Requirement 10).

Answer

System administrator

Answer

Internal auditor

Answer

Certified Public Accountant (CPA)

Question 20

Which of the following is the primary purpose of a security audit?

Accepted Answer

To compare security controls against a defined standard. A security audit's primary purpose is to systematically evaluate an organization's security controls against a predefined standard, such as ISO 27001, NIST SP 800-53, or PCI DSS. This comparison verifies compliance and identifies gaps, not merely vulnerabilities. Unlike a vulnerability assessment or penetration test, an audit focuses on adherence to criteria, not exploitation or informal review.

Answer

To identify vulnerabilities in the network

Answer

To perform an informal evaluation of security posture

Answer

To exploit vulnerabilities and demonstrate impact