CISSP Security Assessment and Testing — 40 Questions

Question 1

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

Accepted Answer

Manually verify a sample of the findings to confirm true vs. false positives.. Option B is correct because manual verification is the definitive method to distinguish true positives from false positives in vulnerability scanning. Automated scanners can produce false positives due to factors like incomplete service fingerprinting or reliance on banner grabbing, which may not reflect actual exploitability. The analyst must validate a representative sample of findings against the actual application behavior and configuration before taking further action.

Answer

Re-scan the application with the same settings to confirm the results.

Answer

Escalate all critical findings to management immediately.

Answer

Retune the vulnerability scanner to reduce false positives and re-scan.

Question 2

A company is implementing a continuous monitoring program for its cloud infrastructure. Which of the following metrics would be MOST useful for detecting unauthorized changes to production systems?

Accepted Answer

Configuration drift from a known good baseline.. Configuration drift from a known good baseline is the most effective metric for detecting unauthorized changes because it directly compares the current state of production systems against a secure, approved baseline (e.g., using tools like AWS Config, Azure Policy, or Chef InSpec). Any deviation—such as altered file permissions, unexpected services, or modified registry keys—triggers an alert, enabling rapid detection of unauthorized modifications. This aligns with continuous monitoring principles in cloud security, focusing on integrity rather than performance or access patterns.

Answer

Network throughput between application tiers.

Answer

Average CPU load across all systems.

Answer

Number of failed login attempts per hour.

Question 3

A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?

Accepted Answer

Ping sweep using ICMP echo requests.. A ping sweep using ICMP echo requests (ICMP Type 8) is the most appropriate first step for identifying live hosts on a network because it is a standard, low-disruption method that quickly determines host availability. ICMP echo requests are typically allowed by default on many networks and do not initiate full protocol handshakes or service interactions, minimizing the risk of triggering alarms or causing instability. This aligns with the penetration testing methodology of starting with passive or low-impact reconnaissance before escalating to more intrusive techniques.

Answer

ARP scan to discover hosts on the local subnet.

Answer

Vulnerability scan of all IP addresses in the target range.

Answer

Full TCP port scan on common ports.

Question 4

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

Accepted Answer

Sending a phishing email that mimics a common internal communication.. Sending a phishing email that mimics a common internal communication directly tests whether employees can recognize and report a realistic social engineering attempt, which is the primary goal of security awareness training. This scenario evaluates the human firewall by simulating the most prevalent attack vector—email-based phishing—and measures the effectiveness of training in reducing click-through rates and increasing reporting behavior.

Answer

Calling employees and pretending to be IT support to obtain passwords.

Answer

Attempting to tailgate into a secure facility.

Answer

Searching through trash bins for sensitive documents.

Question 5

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

Accepted Answer

Build a replica of the production environment and test against it with realistic attack scenarios.. Option D is correct because building a replica (staging) environment allows the penetration test to simulate realistic attack scenarios without any risk to production data or system availability. This approach ensures the test can include destructive or disruptive techniques (e.g., SQL injection, privilege escalation) that would be unsafe on a live system, while still accurately reflecting the production architecture and configurations.

Answer

Conduct the test on the production environment using anonymized production data.

Answer

Use an automated vulnerability scanner on the production environment.

Answer

Perform the test during off-peak hours on the production system with read-only access.

Question 6

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 7

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 8

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Accepted Answer

Identify vulnerabilities in systems and applications.. A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.

Answer

Exploit vulnerabilities to gain unauthorized access.

Answer

Prioritize threats based on business impact.

Answer

Implement new security controls to address findings.

Question 9

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Accepted Answer

Penetration testing. Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.

Answer

Risk analysis

Answer

Forensic analysis

Question 10

A security analyst receives the IDS alert shown in the exhibit. The analyst checks the web server logs and finds that the request returned a 200 OK status. Which of the following should the analyst do NEXT?

Accepted Answer

Isolate the web server and investigate for data breach.. The IDS alert indicates a SQL injection attempt, and the web server returned a 200 OK status, which means the request was processed successfully. This combination strongly suggests that the injection may have succeeded, potentially leading to a data breach. The correct next step is to isolate the web server and investigate for evidence of data exfiltration or unauthorized access, as per incident response procedures.

Answer

Tune the IDS to reduce false positives for SQL injection signatures.

Answer

Delete the alert and continue monitoring.

Answer

Ignore the alert because the IDS is known to produce false positives.

Question 11

A system administrator receives the vulnerability scan report snippet shown in the exhibit. Which of the following actions should the administrator take to remediate the vulnerability?

Accepted Answer

Modify the SSH configuration to disable weak ciphers and enable strong ciphers.. The vulnerability scan report likely identifies weak cryptographic algorithms (e.g., CBC-mode ciphers or MD5-based MACs) in the SSH configuration. Remediation requires disabling these weak ciphers and enabling strong ones (e.g., AES-CTR, ChaCha20-Poly1305) in the sshd_config file, as simply upgrading the SSH service version may not change the cipher list. Option B directly addresses the cryptographic weakness without unnecessarily disabling or hiding the service.

Answer

Upgrade the SSH service to the latest version.

Answer

Disable SSH access to the host.

Answer

Change the SSH port from 22 to a non-standard port.

Question 12

A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?

Accepted Answer

Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.. Option C is correct because the root cause is that privileged accounts can bypass MFA when accessing systems via API calls, and long-lived session tokens (24 hours) provide a wide window for attackers to reuse stolen tokens. Requiring MFA for all privileged access methods, including APIs, closes the authentication gap, and reducing session token expiration to 15 minutes minimizes the impact of token theft by limiting the reuse window. This directly addresses the two key vulnerabilities identified in the assessment.

Answer

Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.

Answer

Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.

Answer

Replace API tokens with certificate-based authentication for all privileged accounts.

Question 13

Drag and drop the steps of the incident response process in the correct order.

Question 14

Drag and drop the steps for a secure password change procedure in the correct order.

Question 15

Match each cryptographic algorithm to its type.

Question 16

Match each security assessment type to its description.

Question 17

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Accepted Answer

Static application security testing (SAST). Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.

Answer

Fuzz testing

Answer

Manual penetration testing

Answer

Dynamic application security testing (DAST)

Question 18

A vulnerability scan report shows that a web server has a critical vulnerability with a CVSS score of 9.8. However, the server is behind a WAF that blocks the attack vector, and the vulnerability is in a deprecated feature that cannot be removed until the next major release. What should the security manager do first?

Accepted Answer

Document the compensating control and accept the residual risk. Option C is correct because the WAF serves as a compensating control that effectively mitigates the attack vector for this vulnerability, and the residual risk has been formally documented and accepted by management. In the absence of an immediate patch or removal of the deprecated feature, documenting the compensating control and accepting the residual risk is the appropriate risk management decision per the organization's risk appetite and the NIST SP 800-30 risk assessment framework.

Answer

Remove the server from production

Answer

Ignore the finding because the WAF blocks it

Answer

Immediately patch the vulnerability

Question 19

During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?

Accepted Answer

Migrate to a widely-accepted encryption standard such as AES. Custom encryption algorithms are highly risky because they have not undergone the extensive peer review and cryptanalysis that standards like AES have. Even if the developer claims better efficiency, the lack of proven security guarantees makes the application vulnerable to attacks. The correct recommendation is to migrate to a widely-accepted standard such as AES, which is FIPS 197 validated and trusted for protecting sensitive financial data.

Answer

Conduct additional penetration testing on the encryption implementation

Answer

Accept the risk if the algorithm is more efficient

Answer

Perform a cryptoanalysis of the algorithm to validate its strength

Question 20

A security analyst reviews system logs and notices multiple failed SSH login attempts from a single IP address over the past hour. The attempts are spaced 30 seconds apart and target different usernames. Which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The observed pattern—multiple failed SSH login attempts from a single IP, spaced 30 seconds apart, targeting different usernames—is characteristic of a brute force password guessing attack. Unlike a dictionary attack, which uses a precompiled list of likely passwords, a brute force attack systematically tries all possible password combinations for each username, often with a delay to evade rate limiting.

Answer

Distributed denial-of-service (DDoS) attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack