easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A security professional is tasked with testing…
A security professional is tasked with testing the effectiveness of security controls in a production environment without causing disruption. Which type of assessment should be performed?
⚠ Common exam trap
A common mix-up: candidates confuse a vulnerability scan with a penetration test, assuming both involve active exploitation, but the key distinction is that a vulnerability scan is passive and non-destructive, while a penetration test is active and potentially disruptive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability scan
A vulnerability scan is the correct choice because it is a non-intrusive, automated assessment that identifies known vulnerabilities (e.g., missing patches, misconfigurations) by comparing system states against a database of CVEs and configuration benchmarks (e.g., CIS benchmarks). It does not exploit vulnerabilities or generate attack traffic, making it safe for production environments. In contrast, penetration tests and red team exercises involve active exploitation and simulated attacks that risk service disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Penetration test
Why it's wrong here
A penetration test involves authorized, simulated attacks against a system to identify exploitable vulnerabilities and demonstrate the potential impact of a successful breach. Unlike a vulnerability scan, it actively attempts to exploit identified weaknesses, which carries an inherent risk of service disruption or data corruption, making it less suitable for routine, non-disruptive assessments of technical controls.
- ✗
Red team exercise
Why it's wrong here
A red team exercise simulates a sophisticated, persistent adversary attempting to achieve specific objectives within an organization, often targeting people, processes, and technology. This comprehensive, adversarial approach goes beyond technical exploitation to test the entire security posture, including detection and response capabilities, and inherently involves a high potential for operational impact and disruption due to its real-world attack simulation.
- ✓
Vulnerability scan
Why this is correct
A vulnerability scan is an automated, non-intrusive assessment that identifies known security weaknesses, misconfigurations, and missing patches in systems and applications. It passively checks for indicators of vulnerabilities without attempting to exploit them, making it a safe and efficient method for regularly assessing technical controls in production environments without causing disruption.
- ✗
Social engineering test
Why it's wrong here
A social engineering test assesses an organization's human element by attempting to manipulate individuals into divulging confidential information or performing actions that compromise security. This type of test specifically targets human vulnerabilities through methods like phishing or pretexting, and therefore does not directly evaluate the effectiveness of technical security controls, which are designed to protect against automated or technical attacks.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.