The answer is the OpenSSL Heartbleed vulnerability because it poses the most immediate and severe risk to data confidentiality and system integrity. Unlike SSH weak MAC algorithms, which merely reduce cryptographic strength without directly exposing data, or an SMTP open relay, which enables spam but not direct data theft, Heartbleed (CVE-2014-0160) allows an attacker to read up to 64 KB of server memory, potentially leaking private keys, session tokens, and passwords. On the CISSP exam, this scenario tests your ability to prioritize vulnerabilities based on impact and likelihood, a core concept in risk management. A common trap is to focus on the number of vulnerabilities rather than their severity; remember that a single critical flaw like Heartbleed can compromise all encrypted communications, making it the top priority. Memory tip: “Heartbleed bleeds secrets, not just bandwidth.”
CISSP Security Assessment and Testing Practice Question
This CISSP practice question tests your understanding of security assessment and testing. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
Vulnerability Scan Report (excerpt):
Host: 192.168.1.100
Port: 443 (https)
Vulnerability ID: 12345
Plugin: OpenSSL Heartbleed Detection
Output: Vulnerable to Heartbleed (CVE-2014-0160)
Host: 192.168.1.100
Port: 22 (ssh)
Vulnerability ID: 67890
Plugin: SSH Weak MAC Algorithms
Output: Server supports weak MAC algorithms (hmac-md5, hmac-sha1-96)
Host: 192.168.1.100
Port: 25 (smtp)
Vulnerability ID: 11111
Plugin: SMTP Open Relay
Output: Server is an open relay.
Based on the vulnerability scan exhibit, which vulnerability should be remediated first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OpenSSL Heartbleed vulnerability
The OpenSSL Heartbleed vulnerability (CVE-2014-0160) allows an attacker to read up to 64 KB of memory from a vulnerable server, potentially exposing private keys, session tokens, and passwords. This is a critical remote code execution and information disclosure flaw that requires immediate remediation because it compromises the confidentiality of all encrypted communications. In contrast, the other vulnerabilities are less severe: SSH weak MAC algorithms reduce cryptographic strength but do not directly leak data, and SMTP open relay is a misconfiguration that enables spam but not direct data theft.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
All vulnerabilities equally because they have the same host
Why it's wrong here
Severity varies.
✗
SSH weak MAC algorithms
Why it's wrong here
Less critical than Heartbleed.
✗
SMTP open relay
Why it's wrong here
Medium severity; spam risk.
✓
OpenSSL Heartbleed vulnerability
Why this is correct
Critical vulnerability with known exploitation.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may prioritize SMTP open relay or SSH weak MAC algorithms because they sound like common misconfigurations, but the CISSP exam emphasizes that vulnerabilities with direct, remote exploitation for data disclosure (like Heartbleed) must be remediated first under the principle of risk prioritization.
Detailed technical explanation
How to think about this question
Heartbleed exploits a missing bounds check in the OpenSSL implementation of the TLS Heartbeat Extension (RFC 6520). A malicious heartbeat request with a short payload but a claimed length of up to 64 KB causes the server to respond with uninitialized memory from the heap, which may contain previously processed data like private keys or session IDs. In real-world attacks, this vulnerability was used to steal private keys from major websites, enabling decryption of past and future traffic.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Security Assessment and Testing — This question tests Security Assessment and Testing — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: OpenSSL Heartbleed vulnerability — The OpenSSL Heartbleed vulnerability (CVE-2014-0160) allows an attacker to read up to 64 KB of memory from a vulnerable server, potentially exposing private keys, session tokens, and passwords. This is a critical remote code execution and information disclosure flaw that requires immediate remediation because it compromises the confidentiality of all encrypted communications. In contrast, the other vulnerabilities are less severe: SSH weak MAC algorithms reduce cryptographic strength but do not directly leak data, and SMTP open relay is a misconfiguration that enables spam but not direct data theft.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.