CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use of only automated tools

  Why it's wrong here

  The Rules of Engagement (RoE) define the permissible methods and scope of a security assessment, which may include a mix of automated and manual techniques. While an RoE might specify particular tools or even restrict testing to automated methods for certain scenarios, the exclusive use of automated tools is a specific operational detail, not a universal, foundational component of the RoE document itself. RoE primarily establish the legal, ethical, and logistical boundaries for the engagement.

• ✗

  Guarantee of no system disruption

  Why it's wrong here

  A guarantee of no system disruption is an unrealistic expectation for any comprehensive security assessment, as even carefully planned tests carry inherent risks. Instead, the Rules of Engagement (RoE) typically outline acceptable levels of risk, define clear communication channels for unexpected impacts, and establish specific "emergency stop" criteria and procedures to mitigate and respond to any unintended service interruptions or system degradations. This acknowledges potential disruption rather than guaranteeing its absence.

• ✓

  Written authorization from management

  Why this is correct

  Written authorization from management is a paramount and non-negotiable component of the Rules of Engagement (RoE) for any security assessment. This formal documentation provides explicit legal and ethical permission to conduct activities that might otherwise be considered unauthorized access or a criminal act, clearly defining the scope, targets, and duration of the engagement and protecting both the assessors and the organization from liability.

• ✗

  Identification of all vulnerabilities

  Why it's wrong here

  Identifying all vulnerabilities is a primary objective or desired outcome of a security assessment, rather than a fundamental component of the Rules of Engagement (RoE) themselves. The RoE primarily define the scope, boundaries, methodologies, and communication protocols for the assessment, establishing the framework within which the objective of vulnerability identification is pursued, but not dictating the completeness or guarantee of findings.

Go deeper

Related to this question