mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Test the effectiveness of its security controls…
A company wants to test the effectiveness of its security controls without causing disruption. Which type of assessment is most appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between passive identification (vulnerability scan) and active exploitation (penetration test), where candidates mistakenly choose penetration test because they think it provides a more thorough assessment, ignoring the explicit 'without causing disruption' constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability scan
A vulnerability scan is the most appropriate assessment because it passively identifies known vulnerabilities (e.g., missing patches, misconfigurations) without exploiting them, ensuring no disruption to production systems. Unlike active exploitation tests, vulnerability scanners use non-intrusive probes (e.g., banner grabbing, version fingerprinting) that do not trigger denial-of-service or system crashes. This aligns with the requirement to test control effectiveness while maintaining operational stability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Penetration test
Why it's wrong here
Penetration testing involves actively exploiting identified vulnerabilities to simulate a real-world attack and assess the resilience of security controls. While highly effective at demonstrating actual risk, this method is inherently intrusive and carries a significant risk of service disruption, data corruption, or system instability, making it unsuitable when minimizing operational impact is a primary concern for simply testing effectiveness.
- ✗
Security audit
Why it's wrong here
A security audit primarily focuses on evaluating an organization's adherence to established policies, standards, regulations, and best practices through documentation review, interviews, and process observation. It assesses the existence and proper implementation of controls from a compliance and governance perspective, but it does not directly measure the technical effectiveness of those controls in actively mitigating threats or preventing exploitation.
- ✓
Vulnerability scan
Why this is correct
A vulnerability scan systematically identifies known security weaknesses and misconfigurations in systems, applications, and networks by passively probing for indicators of potential vulnerabilities. This method is non-intrusive, does not attempt to exploit findings, and therefore minimizes the risk of service disruption, making it an ideal, low-impact approach for regularly assessing the presence of security flaws and the general effectiveness of baseline controls.
- ✗
Red team exercise
Why it's wrong here
A red team exercise is a comprehensive, goal-based simulation designed to test an organization's overall defensive capabilities against a sophisticated, persistent threat actor. These highly adversarial engagements involve multiple attack vectors and often attempt to achieve specific objectives, making them inherently intrusive, resource-intensive, and prone to causing significant operational disruption, far beyond a simple effectiveness check.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.