CISSP Security Assessment and Testing Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. Based on the exhibit, what is the most urgent remediation?

Accepted Answer

Upgrade to Apache 2.4.50. The exhibit shows Apache 2.4.49 is in use, which is vulnerable to CVE-2021-41773 — a path traversal and remote code execution flaw in the `mod_cgi` module. Upgrading to Apache 2.4.50 is the most urgent remediation because it directly patches this critical vulnerability, preventing attackers from reading arbitrary files or executing commands via crafted URL paths like `/cgi-bin/.%2e/%2e%2e/bin/sh`.

Answer

Disable directory listing

Answer

Recompile Apache with security flags

Answer

Apply a WAF rule to block path traversal attempts

Question 2

A security analyst is conducting a review of aggregated logs from firewalls, IDS, and servers to detect anomalous behavior. This activity is best described as:

Accepted Answer

Security log analysis. Security log analysis involves the systematic review of logs from firewalls, IDS, and servers to identify patterns, anomalies, or indicators of compromise. This activity directly matches the scenario of detecting anomalous behavior through aggregated log review, which is a core practice in security monitoring and incident detection.

Answer

Risk assessment

Answer

Vulnerability scanning

Answer

Penetration testing

Question 3

During an internal security assessment, a tester uses a tool to attempt to crack password hashes extracted from a domain controller. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation. C is correct because cracking password hashes extracted from a domain controller occurs after the tester has already gained access to the system. This activity is part of the post-exploitation phase, where the tester escalates privileges, extracts credentials, and moves laterally. In this context, the tester is using a tool like John the Ripper or Hashcat to crack NTLM hashes, which is a classic post-exploitation step to obtain plaintext passwords for further access.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 4

A company's security team discovers that a critical web application has a SQL injection vulnerability. However, the team is unable to remediate it immediately due to a dependency on a third-party component. Which of the following is the BEST approach to manage the risk while awaiting a patch?

Accepted Answer

Accept the risk and implement compensating controls like input validation at the network layer. Option A is correct because when a vulnerability cannot be patched immediately, compensating controls are the best risk management approach. Implementing input validation at the network layer (e.g., via a web application firewall or network-based IPS) can block SQL injection patterns before they reach the vulnerable application, reducing the likelihood of exploitation without requiring changes to the third-party component.

Answer

Deploy a web application firewall with a rule to block SQL injection patterns

Answer

Increase logging and monitoring of the application

Answer

Disable the vulnerable feature entirely

Question 5

A security professional is tasked with testing the effectiveness of security controls in a production environment without causing disruption. Which type of assessment should be performed?

Accepted Answer

Vulnerability scan. A vulnerability scan is the correct choice because it is a non-intrusive, automated assessment that identifies known vulnerabilities (e.g., missing patches, misconfigurations) by comparing system states against a database of CVEs and configuration benchmarks (e.g., CIS benchmarks). It does not exploit vulnerabilities or generate attack traffic, making it safe for production environments. In contrast, penetration tests and red team exercises involve active exploitation and simulated attacks that risk service disruption.

Answer

Penetration test

Answer

Red team exercise

Answer

Social engineering test

Question 6

An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.

Answer

Vulnerability scan

Answer

Risk assessment

Answer

Penetration test

Question 7

A security analyst notes that a recent penetration test successfully exploited a vulnerability in a legacy application that cannot be patched. The analyst recommends implementing network segmentation to limit the application's exposure. This recommendation is an example of:

Accepted Answer

Risk mitigation. Implementing network segmentation to limit exposure of an unpatched legacy application is a classic example of risk mitigation. By isolating the application on a separate network segment (e.g., using VLANs or firewall rules), the analyst reduces the likelihood or impact of a successful exploit, even though the underlying vulnerability remains unpatched. This directly aligns with the CISSP definition of risk mitigation: applying controls to reduce risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 8

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify weaknesses and measure control effectiveness. The primary purpose of a security assessment is to systematically identify vulnerabilities, threats, and weaknesses in an organization's information systems, and to evaluate the effectiveness of existing security controls. This aligns with the CISSP domain of Security Assessment and Testing, where the goal is to measure control performance against a baseline, not to immediately remediate or enforce compliance.

Answer

To fix all vulnerabilities immediately

Answer

To ensure compliance with regulations

Answer

To punish non-compliant employees

Question 9

During a web application security test, a tester attempts to inject JavaScript into a search field and observes that the script executes when the page is loaded. This indicates a vulnerability to:

Accepted Answer

Cross-site scripting (XSS). The observed behavior—JavaScript injected into a search field executing when the page loads—is the hallmark of stored (persistent) cross-site scripting (XSS). In this attack, the tester's input is stored on the server (e.g., in a database or log) and later served to other users without proper output encoding, causing the browser to interpret the injected script as part of the page's HTML DOM. This directly violates the same-origin policy and allows arbitrary script execution in the context of the victim's session.

Answer

SQL injection

Answer

Command injection

Answer

Cross-site request forgery (CSRF)

Question 10

A security team is evaluating the results of a penetration test. The test revealed that a low-privileged user could escalate privileges to domain administrator. This is a critical finding. Which of the following should be the immediate next step?

Accepted Answer

Implement patch management for the exploited vulnerability. Option D is correct because the immediate priority after discovering a privilege escalation vulnerability is to remediate the root cause—typically a missing patch or misconfiguration—to prevent further exploitation. In a penetration test context, the finding indicates a technical flaw (e.g., a missing security update for CVE-2021-42287 or a misconfigured Active Directory ACL) that must be patched or hardened first. Full incident response (A) is premature without evidence of active compromise, and re-imaging (B) or account termination (C) are reactive measures that do not address the underlying vulnerability.

Answer

Conduct a full incident response

Answer

Re-image all affected systems

Answer

Terminate the user's account

Question 11

A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)

Accepted Answer

Identification of missing security patches. A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.

Answer

Attempting to crack password hashes

Answer

Social engineering attacks against employees

Answer

Exploiting identified vulnerabilities to gain unauthorized access

Question 12

A security analyst is reviewing log data from various sources. Which of the following are essential for effective security logging in accordance with best practices? (Select THREE.)

Accepted Answer

Secure transmission of logs to a central repository. Option B is correct because logs must be transmitted securely to a central repository to prevent tampering, interception, or unauthorized disclosure during transit. Best practices require the use of encrypted channels such as TLS (e.g., syslog over TLS per RFC 5425) or IPsec to ensure confidentiality and integrity of log data while in motion.

Answer

Storage of logs in plaintext format only

Answer

Log retention of at least one year

Question 13

A penetration tester is planning an engagement. Which of the following rules of engagement should be defined before testing begins? (Select TWO.)

Accepted Answer

Emergency contact procedures. Emergency contact procedures (B) are a critical component of the Rules of Engagement (RoE) because they define who to notify if an incident occurs during testing, such as an unintended system outage or detection by security monitoring. Without this, the tester risks legal or operational repercussions. The scope of systems to be tested (C) is equally essential as it explicitly lists IP ranges, hostnames, and network segments authorized for testing, preventing unauthorized access and ensuring compliance with the engagement contract.

Answer

The exact exploits to be used

Answer

The tester's personal compensation

Answer

The names of employees to be targeted

Question 14

Your organization is a medium-sized e-commerce company with a hybrid infrastructure: on-premises datacenter and AWS cloud. The security team recently conducted an internal vulnerability scan of the on-premises network and discovered multiple critical vulnerabilities in a legacy ERP system that cannot be patched because the vendor no longer supports it. The ERP system is essential for order processing and cannot be decommissioned. The team also ran a penetration test against the cloud environment and found that an attacker with network access could leverage misconfigured security groups to move laterally between instances. The company has a risk appetite that allows for limited risk acceptance with compensating controls. As the senior security analyst, what is the BEST course of action?

Accepted Answer

Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.. Option B provides compensating controls: virtual patching for the ERP vulnerabilities and stricter security group rules to restrict lateral movement in the cloud. This aligns with the risk appetite by reducing risk without immediate replacement. Option A is too disruptive, option C ignores the need for controls, and option D is a long-term solution that would cause unacceptable disruption.

Answer

Immediately isolate the legacy ERP system from the network and implement a manual workaround for order processing.

Answer

Decommission the legacy ERP system and migrate to a modern alternative, accepting a temporary disruption in operations.

Answer

Accept the risk for both findings and document them in the risk register without additional controls.

Question 15

A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?

Accepted Answer

Check the application logs for database error messages.. Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.

Answer

Use a manual SQL injection tool like sqlmap to test the application.

Answer

Implement prepared statements in the application code.

Answer

Run a vulnerability scan with a SQL injection detection module.

CISSP Security Assessment and Testing Practice Test 4 — 15 Questions

Exhibit

CISSP Security Assessment and Testing Practice Test 4 — 15 Questions

Exhibit