CISSP Security Assessment and Testing Practice Test 2 — 15 Questions

Question 1

Match each security assessment type to its description.

Question 2

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Accepted Answer

Static application security testing (SAST). Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.

Answer

Fuzz testing

Answer

Manual penetration testing

Answer

Dynamic application security testing (DAST)

Question 3

A vulnerability scan report shows that a web server has a critical vulnerability with a CVSS score of 9.8. However, the server is behind a WAF that blocks the attack vector, and the vulnerability is in a deprecated feature that cannot be removed until the next major release. What should the security manager do first?

Accepted Answer

Document the compensating control and accept the residual risk. Option C is correct because the WAF serves as a compensating control that effectively mitigates the attack vector for this vulnerability, and the residual risk has been formally documented and accepted by management. In the absence of an immediate patch or removal of the deprecated feature, documenting the compensating control and accepting the residual risk is the appropriate risk management decision per the organization's risk appetite and the NIST SP 800-30 risk assessment framework.

Answer

Remove the server from production

Answer

Ignore the finding because the WAF blocks it

Answer

Immediately patch the vulnerability

Question 4

During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?

Accepted Answer

Migrate to a widely-accepted encryption standard such as AES. Custom encryption algorithms are highly risky because they have not undergone the extensive peer review and cryptanalysis that standards like AES have. Even if the developer claims better efficiency, the lack of proven security guarantees makes the application vulnerable to attacks. The correct recommendation is to migrate to a widely-accepted standard such as AES, which is FIPS 197 validated and trusted for protecting sensitive financial data.

Answer

Conduct additional penetration testing on the encryption implementation

Answer

Accept the risk if the algorithm is more efficient

Answer

Perform a cryptoanalysis of the algorithm to validate its strength

Question 5

A security analyst reviews system logs and notices multiple failed SSH login attempts from a single IP address over the past hour. The attempts are spaced 30 seconds apart and target different usernames. Which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The observed pattern—multiple failed SSH login attempts from a single IP, spaced 30 seconds apart, targeting different usernames—is characteristic of a brute force password guessing attack. Unlike a dictionary attack, which uses a precompiled list of likely passwords, a brute force attack systematically tries all possible password combinations for each username, often with a delay to evade rate limiting.

Answer

Distributed denial-of-service (DDoS) attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Question 6

An organization is planning a penetration test of its internal network. The test team has been given network diagrams, source code access, and administrative credentials. This type of testing is known as:

Accepted Answer

White-box testing. White-box testing (also known as clear-box or structural testing) is characterized by the test team having full knowledge of the internal system architecture, including network diagrams, source code, and administrative credentials. This level of access allows testers to perform a thorough analysis of the application logic, configuration weaknesses, and potential backdoors that would be invisible in a black-box approach. The scenario explicitly states the team was given these artifacts, making white-box testing the correct classification.

Answer

Black-box testing

Answer

Red team testing

Answer

Gray-box testing

Question 7

A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Penetration test

Question 8

A security tester needs to test a new application for vulnerabilities but is concerned about contaminating the production database with test data. What is the best practice for conducting such tests?

Accepted Answer

Create a separate test environment with anonymized production data. Option B is correct because creating a separate test environment with anonymized production data ensures that testing does not affect the integrity or availability of the production database while still using realistic data to uncover vulnerabilities. Anonymization techniques, such as data masking or tokenization, remove personally identifiable information (PII) while preserving referential integrity and data distribution, allowing for accurate security testing without contaminating production systems.

Answer

Perform the test on the production environment during off-hours

Answer

Test only from the network perimeter to avoid data exposure

Answer

Use synthetic data that mimics production but is not real

Question 9

A vulnerability scanner reports a medium-severity finding on a web server. After investigating, the system administrator claims the finding is a false positive because the service in question is not actually running. Which step should the security analyst take next?

Accepted Answer

Verify the service status using system commands or network scans. Option A is correct because the security analyst must independently verify the administrator's claim before taking any action. The vulnerability scanner may have detected a service on a different port or the service may be bound to a non-standard interface; using system commands (e.g., `netstat -tulpn` or `ss -tulpn`) or a targeted network scan (e.g., `nmap -sV -p `) provides objective evidence of whether the service is actually listening. Relying solely on the administrator's assertion without verification could lead to a missed true positive, especially if the service is hidden or misconfigured.

Answer

Remove the finding from the report since the administrator confirmed it

Answer

Close the finding as accepted risk

Answer

Escalate the issue to management for risk acceptance

Question 10

A red team exercise is planned to simulate a sophisticated adversary. The blue team is aware of the exercise but not the exact methods. The red team is given a budget to acquire attack tools. What is the primary advantage of this approach over a traditional penetration test?

Accepted Answer

It evaluates the organization's detection and response capabilities. Option C is correct because a red team exercise with a known-but-not-detailed blue team specifically tests the organization's detection and response capabilities under realistic adversarial conditions. Unlike a traditional penetration test, which focuses on identifying vulnerabilities, this approach evaluates how well the blue team can detect, analyze, and respond to stealthy, multi-stage attacks that mimic a sophisticated adversary. The red team's budget for attack tools allows them to simulate advanced persistent threats (APTs) that challenge the blue team's security operations center (SOC) processes and incident response procedures.

Answer

It ensures that the blue team is not alerted to the test

Answer

It provides comprehensive vulnerability coverage

Answer

It is more cost-effective than a penetration test

Question 11

A security analyst is reviewing the findings from a vulnerability scan of a web application. Which TWO actions are most appropriate to prioritize remediation?

Accepted Answer

Whether a known exploit exists. Option C is correct because the existence of a known exploit indicates that the vulnerability is actively weaponized, making it a higher priority for remediation regardless of its CVSS score. A vulnerability with a published exploit in frameworks like Metasploit or Exploit-DB poses an immediate, tangible risk to the web application, as attackers can easily leverage it without developing custom code. This aligns with the principle of prioritizing based on threat likelihood, not just severity.

Answer

The asset's value to the organization

Answer

The number of times the scan was run

Answer

The date the vulnerability was discovered

Question 12

An organization is implementing a security information and event management (SIEM) system. Which THREE factors are most critical for the SIEM to provide actionable security insights?

Accepted Answer

Real-time alerting capabilities. Real-time alerting is critical because SIEM must detect and notify security teams of ongoing threats within seconds to minutes, enabling timely incident response. Without near-instantaneous correlation and alerting, attackers can achieve their objectives (e.g., lateral movement, data exfiltration) before the organization even knows an incident occurred. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis must be rapid to contain damage.

Answer

Ability to store raw logs for one year

Answer

Low false-positive rate

Question 13

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Accepted Answer

Input validation testing. Input validation testing (A) is correct because it directly addresses common web application attacks such as SQL injection, cross-site scripting (XSS), and command injection by ensuring that all user-supplied data is properly sanitized, validated, and encoded before processing. Without rigorous input validation, an attacker can manipulate input fields to execute arbitrary code or access unauthorized data, making this a foundational security control in the OWASP Top 10.

Answer

Network segmentation testing

Answer

Load testing

Question 14

Based on the vulnerability scan exhibit, which vulnerability should be remediated first?

Accepted Answer

OpenSSL Heartbleed vulnerability. The OpenSSL Heartbleed vulnerability (CVE-2014-0160) allows an attacker to read up to 64 KB of memory from a vulnerable server, potentially exposing private keys, session tokens, and passwords. This is a critical remote code execution and information disclosure flaw that requires immediate remediation because it compromises the confidentiality of all encrypted communications. In contrast, the other vulnerabilities are less severe: SSH weak MAC algorithms reduce cryptographic strength but do not directly leak data, and SMTP open relay is a misconfiguration that enables spam but not direct data theft.

Answer

All vulnerabilities equally because they have the same host

Answer

SSH weak MAC algorithms

Answer

SMTP open relay

Question 15

An auditor is reviewing the JSON policy exhibit. What is the most likely security issue with this policy?

Accepted Answer

The 'Allow' rule for customers does not restrict based on user identity, only IP. Option C is correct because the policy's 'Allow' rule for customers only restricts access based on source IP address, not on authenticated user identity. This means any user or system within the allowed IP range can access the resource, regardless of whether they are a legitimate customer. In a JSON-based policy (e.g., AWS IAM or Azure RBAC), failing to include a condition that checks user identity (such as a JWT claim or IAM user ARN) creates a significant authorization gap, allowing potential impersonation or lateral movement within the trusted network.

Answer

The policy allows all actions on public_data, which could be exploited

Answer

The policy uses JSON syntax, which is not secure

Answer

The 'Deny' rule uses a wildcard resource, which is too restrictive