How should I use these Security Assessment and Testing practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Assessment and Testing questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Assessment and Testing domain.

CISSP · topic practice

Security Assessment and Testing practice questions

Practise Certified Information Systems Security Professional CISSP Security Assessment and Testing practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Assessment and Testing

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Assessment and Testing

Security Assessment and Testing questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security Assessment and Testing exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security Assessment and Testing questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Assessment and Testing explanation →

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

Trap 1: Re-scan the application with the same settings to confirm the…

Re-scanning with the same settings will produce the same potentially inaccurate results.

Trap 2: Escalate all critical findings to management immediately.

Escalating without verification may waste management's time on false positives.

Trap 3: Retune the vulnerability scanner to reduce false positives and…

Retuning without understanding the current findings may miss real issues.

Study all Security Assessment and Testing common traps →

A
Re-scan the application with the same settings to confirm the results.
Why wrong: Re-scanning with the same settings will produce the same potentially inaccurate results.
B
Manually verify a sample of the findings to confirm true vs. false positives.
Manual verification helps identify false positives and prioritize real vulnerabilities.
C
Escalate all critical findings to management immediately.
Why wrong: Escalating without verification may waste management's time on false positives.
D
Retune the vulnerability scanner to reduce false positives and re-scan.
Why wrong: Retuning without understanding the current findings may miss real issues.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Security Assessment and Testing explanation →

A company is implementing a continuous monitoring program for its cloud infrastructure. Which of the following metrics would be MOST useful for detecting unauthorized changes to production systems?

Trap 1: Network throughput between application tiers.

Network throughput is a performance metric, not a change indicator.

Trap 2: Average CPU load across all systems.

CPU load is a performance metric, not directly related to unauthorized changes.

Trap 3: Number of failed login attempts per hour.

Failed logins indicate access attempts, not system changes.

Study all Security Assessment and Testing common traps →

A
Network throughput between application tiers.
Why wrong: Network throughput is a performance metric, not a change indicator.
B
Average CPU load across all systems.
Why wrong: CPU load is a performance metric, not directly related to unauthorized changes.
C
Number of failed login attempts per hour.
Why wrong: Failed logins indicate access attempts, not system changes.
D
Configuration drift from a known good baseline.
Configuration drift detection directly identifies unauthorized changes to system settings.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Security Assessment and Testing explanation →

A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?

Trap 1: ARP scan to discover hosts on the local subnet.

ARP scan is limited to the local subnet and may not reach all targets.

Trap 2: Vulnerability scan of all IP addresses in the target range.

Vulnerability scanning is typically performed after identifying live hosts.

Trap 3: Full TCP port scan on common ports.

Port scan is more intrusive and should be done after host discovery.

Study all Security Assessment and Testing common traps →

A
ARP scan to discover hosts on the local subnet.
Why wrong: ARP scan is limited to the local subnet and may not reach all targets.
B
Ping sweep using ICMP echo requests.
Ping sweep is a standard, non-disruptive host discovery technique.
C
Vulnerability scan of all IP addresses in the target range.
Why wrong: Vulnerability scanning is typically performed after identifying live hosts.
D
Full TCP port scan on common ports.
Why wrong: Port scan is more intrusive and should be done after host discovery.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Security Assessment and Testing explanation →

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

Trap 1: Calling employees and pretending to be IT support to obtain…

Phone pretexting tests verbal skills but is less directly tied to typical training.

Trap 2: Attempting to tailgate into a secure facility.

Tailgating tests physical security controls, not awareness training.

Trap 3: Searching through trash bins for sensitive documents.

Dumpster diving tests physical disposal policies, not awareness training.

Study all Security Assessment and Testing common traps →

A
Sending a phishing email that mimics a common internal communication.
Phishing emails directly test the awareness training provided to employees.
B
Calling employees and pretending to be IT support to obtain passwords.
Why wrong: Phone pretexting tests verbal skills but is less directly tied to typical training.
C
Attempting to tailgate into a secure facility.
Why wrong: Tailgating tests physical security controls, not awareness training.
D
Searching through trash bins for sensitive documents.
Why wrong: Dumpster diving tests physical disposal policies, not awareness training.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Security Assessment and Testing explanation →

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

Trap 1: Conduct the test on the production environment using anonymized…

Even anonymized data in production poses risk to system stability and availability.

Trap 2: Use an automated vulnerability scanner on the production…

Automated scanning is not a penetration test and lacks the creativity of human testers.

Trap 3: Perform the test during off-peak hours on the production system…

Read-only access limits the test to passive techniques, reducing realism.

Study all Security Assessment and Testing common traps →

A
Conduct the test on the production environment using anonymized production data.
Why wrong: Even anonymized data in production poses risk to system stability and availability.
B
Use an automated vulnerability scanner on the production environment.
Why wrong: Automated scanning is not a penetration test and lacks the creativity of human testers.
C
Perform the test during off-peak hours on the production system with read-only access.
Why wrong: Read-only access limits the test to passive techniques, reducing realism.
D
Build a replica of the production environment and test against it with realistic attack scenarios.
A replica environment allows full attack simulation without risking production data.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Security Assessment and Testing explanation →

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Trap 1: Immediately apply patches to all affected hosts.

Patching without confirmation may be premature if the finding is a false positive.

Trap 2: Remove the hosts from the network until the vulnerability is…

Removing hosts is disruptive and may not be necessary if the vulnerability is not exploitable.

Trap 3: Re-run the scan with a different scanner.

Re-running with a different scanner may introduce variability without confirming the finding.

Study all Security Assessment and Testing common traps →

A
Manually verify the vulnerability on a sample of affected hosts.
Manual verification confirms the finding and reduces false positives.
B
Immediately apply patches to all affected hosts.
Why wrong: Patching without confirmation may be premature if the finding is a false positive.
C
Remove the hosts from the network until the vulnerability is resolved.
Why wrong: Removing hosts is disruptive and may not be necessary if the vulnerability is not exploitable.
D
Re-run the scan with a different scanner.
Why wrong: Re-running with a different scanner may introduce variability without confirming the finding.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Security Assessment and Testing explanation →

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Trap 1: Perform a vulnerability scan on the web application with the WAF…

Testing without the WAF does not assess its effectiveness.

Trap 2: Review the WAF logs for any blocked attacks.

Log review only shows past attacks, not the WAF's ability to handle new ones.

Trap 3: Run an automated web application scanner against the application…

Automated scanners may not bypass WAF rules as a skilled attacker would.

Study all Security Assessment and Testing common traps →

A
Conduct a penetration test that includes attempts to bypass the WAF.
A penetration test with WAF bypass attempts provides a realistic assessment of its effectiveness.
B
Perform a vulnerability scan on the web application with the WAF disabled.
Why wrong: Testing without the WAF does not assess its effectiveness.
C
Review the WAF logs for any blocked attacks.
Why wrong: Log review only shows past attacks, not the WAF's ability to handle new ones.
D
Run an automated web application scanner against the application with the WAF enabled.
Why wrong: Automated scanners may not bypass WAF rules as a skilled attacker would.

Full breakdown with real-world context →

Question 8mediummulti select

Read the full Security Assessment and Testing explanation →

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Trap 1: Exploit vulnerabilities to gain unauthorized access.

Exploitation is part of penetration testing, not a general assessment objective.

Trap 2: Prioritize threats based on business impact.

Threat prioritization is part of risk management, not the assessment phase.

Trap 3: Implement new security controls to address findings.

Implementation is a remediation step, not part of the assessment itself.

Study all Security Assessment and Testing common traps →

A
Identify vulnerabilities in systems and applications.
Vulnerability identification is a primary goal of security assessments.
B
Assess the effectiveness of existing security controls.
Evaluating control effectiveness is a core assessment objective.
C
Exploit vulnerabilities to gain unauthorized access.
Why wrong: Exploitation is part of penetration testing, not a general assessment objective.
D
Prioritize threats based on business impact.
Why wrong: Threat prioritization is part of risk management, not the assessment phase.
E
Implement new security controls to address findings.
Why wrong: Implementation is a remediation step, not part of the assessment itself.

Full breakdown with real-world context →

Question 9hardmulti select

Read the full Security Assessment and Testing explanation →

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Trap 1: Risk analysis

Risk analysis is a risk management process, not a testing method.

Trap 2: Forensic analysis

Forensic analysis is used for incident response, not proactive assessment.

Study all Security Assessment and Testing common traps →

A
Risk analysis
Why wrong: Risk analysis is a risk management process, not a testing method.
B
Penetration testing
Penetration testing is a common assessment method.
C
Security auditing
Security auditing is a method of assessing compliance and controls.
D
Forensic analysis
Why wrong: Forensic analysis is used for incident response, not proactive assessment.
E
Vulnerability scanning
Vulnerability scanning is a standard assessment method.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full Security Assessment and Testing explanation →

A security analyst receives the IDS alert shown in the exhibit. The analyst checks the web server logs and finds that the request returned a 200 OK status. Which of the following should the analyst do NEXT?

Exhibit

Refer to the exhibit.

```
[IDS Alert]
Timestamp: 2024-03-15 14:32:17
Signature: ET WEB_SERVER SQL Injection Attempt
Source IP: 192.168.1.105
Destination IP: 10.0.0.5
Destination Port: 80
Payload: GET /search.php?q=1' OR '1'='1' HTTP/1.1
```

Exhibit:

Trap 1: Tune the IDS to reduce false positives for SQL injection signatures.

The IDS correctly identified the attack; tuning may cause missed detections.

Trap 2: Delete the alert and continue monitoring.

Ignoring a successful attack could lead to data compromise.

Trap 3: Ignore the alert because the IDS is known to produce false…

The 200 OK response suggests the attack was successful, so it should not be ignored.

Study all Security Assessment and Testing common traps →

A
Tune the IDS to reduce false positives for SQL injection signatures.
Why wrong: The IDS correctly identified the attack; tuning may cause missed detections.
B
Delete the alert and continue monitoring.
Why wrong: Ignoring a successful attack could lead to data compromise.
C
Ignore the alert because the IDS is known to produce false positives.
Why wrong: The 200 OK response suggests the attack was successful, so it should not be ignored.
D
Isolate the web server and investigate for data breach.
The successful request indicates a potential breach; immediate containment is necessary.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Security Assessment and Testing explanation →

A system administrator receives the vulnerability scan report snippet shown in the exhibit. Which of the following actions should the administrator take to remediate the vulnerability?

Exhibit

Refer to the exhibit.

```
[Vulnerability Scan Report - Snippet]
Host: 10.0.0.15
Port: 22/tcp
Service: SSH
Vulnerability: Weak SSH Cryptographic Algorithms
Severity: Medium
CVE: CVE-2016-0777
Fix: Disable weak ciphers (arcfour, blowfish-cbc) and enable strong ones (aes256-ctr, aes128-ctr)
```

Exhibit:

Trap 1: Upgrade the SSH service to the latest version.

Upgrading may not change the cipher configuration; it must be explicitly set.

Trap 2: Disable SSH access to the host.

Disabling SSH is too extreme and may impact legitimate access.

Trap 3: Change the SSH port from 22 to a non-standard port.

Changing the port does not fix the weak cipher vulnerability.

Study all Security Assessment and Testing common traps →

A
Upgrade the SSH service to the latest version.
Why wrong: Upgrading may not change the cipher configuration; it must be explicitly set.
B
Modify the SSH configuration to disable weak ciphers and enable strong ciphers.
This directly addresses the vulnerability as recommended in the report.
C
Disable SSH access to the host.
Why wrong: Disabling SSH is too extreme and may impact legitimate access.
D
Change the SSH port from 22 to a non-standard port.
Why wrong: Changing the port does not fix the weak cipher vulnerability.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full NAT/PAT explanation →

A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?

Trap 1: Implement a SIEM system to analyze logs from all sources and create…

Monitoring is important but does not prevent the initial unauthorized access.

Trap 2: Conduct a full audit of privileged account usage and revoke access…

Audit is reactive; it does not prevent future incidents.

Trap 3: Replace API tokens with certificate-based authentication for all…

Certificate-based authentication improves security but does not address the long token expiration issue.

Study all Security Assessment and Testing common traps →

A
Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.
Why wrong: Monitoring is important but does not prevent the initial unauthorized access.
B
Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.
Why wrong: Audit is reactive; it does not prevent future incidents.
C
Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.
This addresses both the lack of MFA and the long token expiration, the root causes.
D
Replace API tokens with certificate-based authentication for all privileged accounts.
Why wrong: Certificate-based authentication improves security but does not address the long token expiration issue.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full Security Assessment and Testing explanation →

Drag and drop the steps of the incident response process in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediumdrag order

Read the full Security Assessment and Testing explanation →

Drag and drop the steps for a secure password change procedure in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Read the full Security Assessment and Testing explanation →

Match each cryptographic algorithm to its type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Symmetric block cipher

Asymmetric (public-key) cipher

Hash function

Keyed-hash message authentication code

Elliptic curve digital signature algorithm

Question 16mediummatching

Read the full Security Assessment and Testing explanation →

Match each security assessment type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Automated check for known vulnerabilities

Simulated attack to exploit vulnerabilities

Systematic evaluation of compliance with policies

Identification and analysis of risks

Question 17easymultiple choice

Read the full Security Assessment and Testing explanation →

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Trap 1: Fuzz testing

Used for finding input handling bugs, not comprehensive vulnerability identification.

Trap 2: Manual penetration testing

Too resource-intensive and not suitable for frequent changes.

Trap 3: Dynamic application security testing (DAST)

Requires a running application and may miss vulnerabilities in early development.

Study all Security Assessment and Testing common traps →

A
Fuzz testing
Why wrong: Used for finding input handling bugs, not comprehensive vulnerability identification.
B
Manual penetration testing
Why wrong: Too resource-intensive and not suitable for frequent changes.
C
Static application security testing (SAST)
Can be integrated into CI/CD and analyze source code without a runtime environment.
D
Dynamic application security testing (DAST)
Why wrong: Requires a running application and may miss vulnerabilities in early development.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Security Assessment and Testing explanation →

A vulnerability scan report shows that a web server has a critical vulnerability with a CVSS score of 9.8. However, the server is behind a WAF that blocks the attack vector, and the vulnerability is in a deprecated feature that cannot be removed until the next major release. What should the security manager do first?

Trap 1: Remove the server from production

Overreaction; compensating controls exist.

Trap 2: Ignore the finding because the WAF blocks it

Formal risk acceptance is needed.

Trap 3: Immediately patch the vulnerability

Patching may not be available or may break functionality.

Study all Security Assessment and Testing common traps →

A
Remove the server from production
Why wrong: Overreaction; compensating controls exist.
B
Ignore the finding because the WAF blocks it
Why wrong: Formal risk acceptance is needed.
C
Document the compensating control and accept the residual risk
Proper risk treatment includes acknowledging existing controls and formal acceptance.
D
Immediately patch the vulnerability
Why wrong: Patching may not be available or may break functionality.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Security Assessment and Testing explanation →

During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?

Trap 1: Conduct additional penetration testing on the encryption…

Testing cannot guarantee security of a custom algorithm.

Trap 2: Accept the risk if the algorithm is more efficient

Efficiency does not justify security risk.

Trap 3: Perform a cryptoanalysis of the algorithm to validate its strength

Even if valid, custom algorithms are not recommended for production.

Study all Security Assessment and Testing common traps →

A
Conduct additional penetration testing on the encryption implementation
Why wrong: Testing cannot guarantee security of a custom algorithm.
B
Accept the risk if the algorithm is more efficient
Why wrong: Efficiency does not justify security risk.
C
Perform a cryptoanalysis of the algorithm to validate its strength
Why wrong: Even if valid, custom algorithms are not recommended for production.
D
Migrate to a widely-accepted encryption standard such as AES
Standard algorithms are extensively reviewed and trusted.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Security Assessment and Testing explanation →

A security analyst reviews system logs and notices multiple failed SSH login attempts from a single IP address over the past hour. The attempts are spaced 30 seconds apart and target different usernames. Which type of attack is most likely occurring?

Trap 1: Distributed denial-of-service (DDoS) attack

DDoS aims to overwhelm resources, not login attempts.

Trap 2: Dictionary attack

Dictionary attacks focus on common passwords, but the pattern here is more generic brute force.

Trap 3: Man-in-the-middle attack

Would not produce login attempts in logs.

Study all Security Assessment and Testing common traps →

A
Distributed denial-of-service (DDoS) attack
Why wrong: DDoS aims to overwhelm resources, not login attempts.
B
Dictionary attack
Why wrong: Dictionary attacks focus on common passwords, but the pattern here is more generic brute force.
C
Brute force password guessing
Systematic repeated login attempts indicate brute force.
D
Man-in-the-middle attack
Why wrong: Would not produce login attempts in logs.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security Assessment and Testing sessions

Start a Security Assessment and Testing only practice session

Every question in these sessions is drawn from the Security Assessment and Testing domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security Assessment and Testing questions →Mixed CISSP session

Frequently asked questions

What does the CISSP exam test about Security Assessment and Testing?: Security Assessment and Testing questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security Assessment and Testing questions in a focused session?: Yes — the session launcher on this page draws every question from the Security Assessment and Testing domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CISSP topics?: Use the topic links above to move to related areas, or go back to the CISSP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CISSP exam covers. They are not copied from any real exam or dump site.

Security Assessment and Testing only

10 questions 20 questions 30 questions 50 questions

Mixed CISSP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CISSP questions Security Assessment and Testing domain overview CISSP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Security Assessment and Testing practice questions

What to know about Security Assessment and Testing

Common Security Assessment and Testing exam traps

Security Assessment and Testing questions

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

A company is implementing a continuous monitoring program for its cloud infrastructure. Which of the following metrics would be MOST useful for detecting unauthorized changes to production systems?

A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

A security analyst receives the IDS alert shown in the exhibit. The analyst checks the web server logs and finds that the request returned a 200 OK status. Which of the following should the analyst do NEXT?

Exhibit

A system administrator receives the vulnerability scan report snippet shown in the exhibit. Which of the following actions should the administrator take to remediate the vulnerability?

Exhibit

Drag and drop the steps of the incident response process in the correct order.

Drag and drop the steps for a secure password change procedure in the correct order.

Match each cryptographic algorithm to its type.

Match each security assessment type to its description.

During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?

A security analyst reviews system logs and notices multiple failed SSH login attempts from a single IP address over the past hour. The attempts are spaced 30 seconds apart and target different usernames. Which type of attack is most likely occurring?

Track your progress over time

Start a Security Assessment and Testing only practice session

Related CISSP topic practice pages

Software Development Security practice questions