CISSP Security Assessment and Testing Practice Question
A security analyst is tasked with identifying vulnerabilities in a network without exploiting them. Which type of assessment is most appropriate?
⚠ Common exam trap
The trap is conflating vulnerability assessment with penetration testing; candidates often pick penetration test because it sounds more thorough, but the key differentiator is that pen tests exploit vulnerabilities, while assessments do not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability assessment
A vulnerability assessment is designed to identify and enumerate vulnerabilities in a system or network without exploiting them. It typically uses automated scanners and manual techniques to produce a report of potential weaknesses. This matches the requirement of identifying vulnerabilities without exploitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vulnerability assessment
Why this is correct
A vulnerability assessment systematically identifies security weaknesses and misconfigurations within systems, applications, or networks. It typically employs automated scanning tools and manual analysis to detect known vulnerabilities, providing a prioritized list of potential risks without attempting to exploit them. This process aims to give an organization a comprehensive overview of its security posture and areas requiring remediation.
- ✗
Security audit
Why it's wrong here
A security audit is a formal, independent examination of an organization's information systems, controls, and processes to determine compliance with established policies, standards, regulations, or best practices. Its primary objective is to provide assurance that security controls are implemented correctly and operating effectively, rather than directly identifying specific technical vulnerabilities through scanning or testing. It focuses on governance and adherence to frameworks.
- ✗
Penetration test
Why it's wrong here
A penetration test, or pen test, is an authorized simulated cyberattack on a computer system, network, or web application to evaluate its security. Unlike a vulnerability assessment, it actively attempts to exploit identified weaknesses to determine if unauthorized access or other malicious activity is possible, demonstrating the potential impact of a successful breach. The goal is to bypass security controls and assess the real-world risk.
- ✗
Security review
Why it's wrong here
A security review is a broader, often less formal evaluation of security documentation, configurations, or architectural designs to identify potential weaknesses or non-compliance with internal policies. It typically involves examining policies, procedures, system configurations, or code without active scanning or exploitation. While it can uncover issues, it lacks the systematic, technical depth of a dedicated vulnerability assessment or penetration test.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.