CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To identify vulnerabilities in the network

  Why it's wrong here

  This statement describes the primary purpose of a vulnerability assessment, which systematically scans and analyzes systems and networks to discover security weaknesses. While a security audit might indirectly uncover vulnerabilities through control failures, its direct objective is not the exhaustive identification of every potential flaw. A security audit primarily evaluates whether established controls are present and operating effectively according to a specific framework or policy, rather than actively seeking out new, unknown vulnerabilities.

• ✓

  To compare security controls against a defined standard

  Why this is correct

  The core function of a security audit is to systematically evaluate an organization's security posture by comparing its implemented security controls, policies, and procedures against a predetermined set of criteria. These criteria typically include industry best practices, regulatory requirements (e.g., GDPR, HIPAA), internal policies, or recognized security frameworks (e.g., ISO 27001, NIST CSF). This comparison determines the degree of compliance and identifies any deviations or gaps that need remediation.

• ✗

  To perform an informal evaluation of security posture

  Why it's wrong here

  A security audit is a formal, structured, and often independent process designed to provide an objective assessment of security controls and compliance. Performing an "informal evaluation" typically refers to a security review or self-assessment, which lacks the rigorous methodology, documentation requirements, and independent verification characteristic of a true audit. Audits are designed to be methodical and evidence-based, not casual or subjective.

• ✗

  To exploit vulnerabilities and demonstrate impact

  Why it's wrong here

  This describes the objective of penetration testing, where authorized ethical hackers actively attempt to exploit identified or discoverable vulnerabilities within a system or network. The goal is to simulate real-world attacks to demonstrate the potential impact of a successful breach and validate the effectiveness of defensive measures. A security audit, conversely, is a non-intrusive process focused on examining documentation, configurations, and control effectiveness without attempting to compromise systems.

Go deeper

Related to this question