Match each security assessment type to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Automated check for known vulnerabilities
Simulated attack to exploit vulnerabilities
Systematic evaluation of compliance with policies
Identification and analysis of risks
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Vulnerability Assessment: Automated scan to identify known vulnerabilities
Correct matches: Vulnerability Assessment uses automated scans; Penetration Test involves exploitation; Security Audit reviews policies; Risk Assessment evaluates risks. Common confusions mix vulnerability assessments with penetration tests.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Vulnerability Assessment: Automated scan to identify known vulnerabilities
Why this is correct
A vulnerability assessment systematically employs automated scanning tools to identify and report known security weaknesses or misconfigurations within systems, networks, or applications. It focuses on discovering potential entry points for attackers without attempting to actively exploit them. This process provides an inventory of vulnerabilities, often ranked by severity, to guide remediation efforts.
Penetration Test: Simulated attack to exploit vulnerabilities and assess impact
Why this is correct
A penetration test, or pen test, involves authorized security professionals simulating real-world cyberattacks against a system or network to actively exploit identified vulnerabilities. The primary goal is to determine the feasibility of an attack, measure the potential impact of a successful breach, and evaluate the effectiveness of existing security controls in preventing or detecting such an intrusion. This goes beyond mere identification, demonstrating actual risk.
Security Audit: Review of policies, procedures, and controls against standards
Why this is correct
A security audit is a formal, systematic evaluation of an organization's information systems, policies, procedures, and security controls against a predefined set of criteria, such as industry standards (e.g., ISO 27001, NIST CSF), regulatory requirements (e.g., HIPAA, GDPR), or internal security policies. Its purpose is to verify compliance, identify gaps in governance, and ensure that security measures are appropriately implemented and effective in mitigating risks.
Risk Assessment: Identification and evaluation of risks to assets
Why this is correct
A risk assessment is a comprehensive process of identifying potential threats and vulnerabilities to an organization's assets, evaluating the likelihood of these threats exploiting vulnerabilities, and determining the potential impact if such an event occurs. This systematic analysis allows organizations to understand their risk exposure, prioritize risks based on severity, and make informed decisions about appropriate risk mitigation strategies to protect critical information and systems.
Vulnerability Assessment: Simulated attack to exploit vulnerabilities and assess impact
Why it's wrong here
This description incorrectly attributes the characteristics of a penetration test to a vulnerability assessment. While both identify weaknesses, a vulnerability assessment primarily uses automated tools to scan for known vulnerabilities without attempting to actively exploit them. The act of simulating an attack to exploit vulnerabilities and assess impact is the defining characteristic of a penetration test, which goes a step further than mere identification.
Penetration Test: Automated scan to identify known vulnerabilities
Why it's wrong here
This statement inaccurately describes a penetration test. An automated scan to identify known vulnerabilities is the core function of a vulnerability assessment, which focuses on passive discovery. A penetration test, in contrast, involves active, manual, and often creative attempts by human testers to exploit identified or discoverable vulnerabilities, mimicking a real attacker's methodology to demonstrate actual system compromise and impact.
Go deeper
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.