🎓 CISSP Practice - Domain 6 - Security Assessment and Testing

Correct Answer: C

Re-performance (also called “re-performance testing”) is the highest-grade evidence because the evaluator independently executes the same steps the control owner performs and measures the actual outcome. Policy review (A) and walk-throughs (B) are persuasive but not conclusive; they rely on documentation and narration rather than observable results. A clean scan (D) only proves a momentary technical state, not the ongoing effectiveness of the managerial or operational control described in the SoA.

Correct Answer: B

With incomplete source, testers must treat the system as a black box and use dynamic testing plus reverse engineering to understand the flaw and verify any compensating controls. White-box (A) is impossible without buildable code, gray-box (C) does not address the module layer, and static binary analysis (D) alone may miss runtime behavior.

Correct Answer: A

Screenshot evidence that is collected and curated by the staff being audited breaks the basic audit principle of independence and reliable evidence (PCI DSS Req. 11.3.4 and ISA 500). Options B, C, and D introduce secondary risk (vendor management, privacy, retention), but the inability to obtain objective, first-hand evidence directly under the QSA’s control is the most fundamental threat to the validity of the assessment.

Correct Answer: B

A high proportion of repeat clickers indicates the training failed to change behavior in the riskiest population, so residual risk remains unacceptably high. While C (statistical significance) and D (benchmarking) are useful, B directly highlights that the most vulnerable cohort is still susceptible, undercutting the “success” claim.

Correct Answer: A

Without regression testing, there is no assurance that fixes remained effective or were not undone by later changes. Executive summaries (B) and attack-path diagrams (C) are useful but do not validate fix durability. Threat intel (D) informs new attacks, but the issue here is failure of previously “fixed” controls.

Correct Answer: C

NIST SP 800-82 specifically cautions that active security testing of live ICS can induce safety incidents and recommends that security assessments of unidirectional devices be performed offline or via vendor-supplied certification evidence. While CA-8 (A) mandates penetration testing, 800-82 provides the contextual exception for safety-critical systems. ISA 62443 (B) describes unidirectional gateways but does not exempt them from testing. ISO 27001 A.8.8 (D) is irrelevant to the issue.

Correct Answer: A

The SOC-2 Type II report is historical (ended 30 Sep 2024) and gives no visibility into control effectiveness after that date. A penetration test conducted after the report period (A) provides up-to-date evidence that key-management controls are still functioning. A Type I report (B) would only give point-in-time design evidence, while ISO-27001 certification (C) is annual and not necessarily focused on key management. Relying on the old SOC-2 (D) ignores the four-month gap.

Correct Answer: A

Version control with peer review is the cornerstone of script integrity; otherwise logic errors or malicious changes could silently invalidate compliance evidence. Running tests only in production (B) is risky and may violate PCI segregation of duties. Write-only ACL (C) and encryption (D) protect confidentiality and immutability but do not address correctness or trustworthiness of the script logic.

Correct Answer: A

PCI DSS req. 11.1 mandates a quarterly wireless scan of all in-scope facilities. An accurate, up-to-date asset inventory (including new pop-up stores) is the trigger that ensures these sites are added to the scan schedule. Without it, the stores were simply overlooked. Encryption choice (B), IDS (C), or SNMP strings (D) are unrelated to scan coverage.

Correct Answer: C

The testers have zero internal knowledge (no source, no design); they must discover vulnerabilities solely through external interaction. This is the definition of black-box testing. White-box (A) and crystal-box (D) both imply full source access, while gray-box (B) would supply partial internal detail.

Correct Answer: B

A large number of high-CVSS findings are often not exploitable in a given deployment context (e.g., library loaded but vulnerable function never called). Analyzing exploitability (reachable code path) allows the team to tune the gate to block only real risk, restoring developer productivity while maintaining security. MTTR (A) is important later but doesn’t explain why the gate is over-blocking. Commits/day (C) is a velocity metric unrelated to risk filtering. TP/FP ratio (D) is SIEM-centric and not directly applicable to library vulnerabilities.

Correct Answer: B

A cryptographically signed SBOM, generated automatically in the pipeline, is tamper-evident and demonstrates that the company knows exactly what code and libraries were shipped—an essential control for supply-chain security. Auditors can later compare the SBOM to vulnerability databases to verify ongoing control effectiveness. DAST (A) is useful but only covers one layer (running app). Runtime firewall logs (C) are operational, not build-time evidence. A post-deployment pentest (D) is manual, point-in-time, and cannot scale to 300 daily releases.

Correct Answer: A

A formal rules-of-engagement (RoE) document is the primary safeguard to prevent collateral damage, define scope, and provide legal authorization (sometimes called “get-out-of-jail-free”). Insurance (B) is secondary, certification (C) is not required by CISSP best practice, and timely reporting (D) is good but does not mitigate operational/legal risk during the test.

Correct Answer: A

The unchanged scope ignores the new technology stack (containers), so tests will omit runtime-security issues such as privileged pods, network policies, or image vulnerabilities (A). Legacy issues (B, C, D) were already in scope in 2023 and would continue to be tested.

Correct Answer: B

The question describes the need to confirm that remediation measures neutralize the identified vulnerabilities. This is precisely “re-testing” (B), sometimes called “fix validation.” Regression testing (A) would ensure new code did not break existing functionality, while a post-implementation review (C) is broader and not attack-focused. User-acceptance testing (D) is concerned with business requirements, not security controls.

Correct Answer: C

SP 800-53A is purposefully flexible; the depth and type of assessment procedure are scaled to the impact level, risk, and prior assessment results. Sufficient, appropriate evidence is the goal, not a mechanical checklist of methods.

Correct Answer: A

Risk assessment requires asset-centric, likelihood, and impact data. Mapping bounties to configuration items in the CMDB and adjusting likelihood with real-world exploitability converts raw bug data into risk input. Publicizing researchers (B) is marketing; de-duplication (C) is good hygiene but insufficient for risk scoring; and researchers cannot realistically provide environmental scores (D) without inside knowledge.

Correct Answer: C

PCI-DSS requires that “personnel who conduct the internal vulnerability scans have organizational independence.” A dotted-line report (A) or GPO restrictions (B) do not remove the conflict of interest inherent in the same AD forest. Using a local account (D) still leaves control of the scanning platform inside the same team. Retaining an external managed service (C) provides true third-party independence that satisfies both DSS v4.0 requirement 11.3.1 and the QSA’s expectation.

Correct Answer: B

Unauthenticated scans check banner information that can be misleading if the service did not update its version string or if the scanner lacks privileges to confirm the actual file versions. Without credentials, the scanner cannot reliably determine whether the patch is installed, making a false positive the most defensible explanation.

Correct Answer: C

A sandboxed “dirty laptop” test simulates the real update process and observes whether malware can bridge the air-gap, providing direct evidence without risking production uptime. Social engineering (A) tests people, not the bridging vector. Static firmware analysis (B) misses runtime propagation, and vendor interviews (D) are hearsay.

Correct Answer: B

Purple-team exercises combine attack creativity (red) with defensive visibility (blue) while the continuous sensors (e.g., AttackIQ, Verodin) safely automate exploit techniques to verify that each zero-trust control (micro-segmentation, conditional access, MFA, etc.) fires as expected—producing evidence at scale without outages. Full red-team (A) is valuable but too sporadic. Tabletop (C) is discussion-only. Annual pentest (D) is point-in-time and cannot keep pace with zero-trust drift.

Correct Answer: B

Disabled SAST alerts may hide systemic code-level flaws. A manual secure-code review by an independent party (e.g., internal security team) can identify true positives that were improperly dismissed, providing direct evidence of code security. DAST (A) finds runtime issues but misses many code-level flaws; dependency scans (C) address third-party rather than first-party code; stress-testing the pipeline (D) evaluates process security, not code security.

Correct Answer: A

The CIS AWS Foundations Benchmark v1.5 contains only a handful of S3-related controls (e.g., block-public-access setting) but does not evaluate every bucket policy or ACL for “authenticated-users” grants. Therefore, the metric improved (fewer FAILs) while real risk remained (A). If the scanner lacked creds (B), the findings would have been “ERROR,” not “PASS.” Partition issues (C) or threshold tuning (D) would not selectively hide authenticated-user grants.

Correct Answer: B

Combining data without normalizing severity scales produces an apples-to-oranges aggregation that invalidates the metric. Control mapping (A) relates controls to frameworks, threat modeling (C) identifies new risks, and baselining (D) sets reference points, but none address the immediate comparability problem.

Correct Answer: B

Passive sensors read network traffic without generating probe packets that could reboot or brick sensitive devices. This yields an authoritative inventory and version map (exposure snapshot) with near-zero risk of disruption. Credentialed active scans (A) still send packets that some legacy medical stacks cannot tolerate; pentesting (C) is far too invasive; vendor reports (D) are useful but give a point-in-time view for only the models tested and are not an “authoritative snapshot” of the hospital’s own deployment.

Correct Answer: C

Only option C is a substantive test of operational effectiveness—auditors physically try to violate the policy and observe whether the system blocks them. Interviews (A) and vendor documents (B) are inquiry/inspection procedures that do not prove the control is working. Vulnerability scans (D) test patch state, not access control.

Correct Answer: B

The failure to meet the patching SLA is directly captured by the percentage of high-risk findings open longer than SLA (B). MTTR (A) is a time-based average but does not show compliance with policy. Scanning more assets (C) or the average CVSS (D) does not measure remediation performance.

Correct Answer: B

SCA is fast and catches high-risk third-party flaws, while incremental SAST focuses only on new or modified code, keeping scan time under a few minutes and aligning with “shift-left” goals. Full DAST (A) and fuzzing (D) are too slow per build; manual review (C) is not scalable or automated.

Correct Answer: B

NIST SA-11 stresses that static tools must be configured for the target environment to reduce noise. Tuning rules to recognize internal libraries, safe wrappers, and custom frameworks will shrink the false-positive pile and retain true positives. Dumping the tool (A, C) or hiding issues (D) does not improve security.

Correct Answer: B

The root issue is that a single compromised device reveals a global secret (the hard-coded key). This is a classic “inadequate protection of cryptographic material” finding (B). The key was not generated on the device (A is irrelevant), and no mention is made of certificates (C) or memory corruption (D).

Correct Answer: B

Responsible-disclosure frameworks (e.g., ISO 29147) require coordinated disclosure—both parties agree on publication timing. By silently patching and not communicating, the bank undercuts the researcher’s ability to publish or receive credit, violating coordination (B). The program scope limited payouts to RCE, so declining a bounty (C) is within policy. Credit (A) is secondary to coordination, and the loss-estimate report (D) is unrelated to disclosure ethics.

Correct Answer: A

Treating every CVSS 9+ finding as Sev-1 creates alert fatigue; analysts waste cycles on vulnerabilities that may be unreachable or have no public exploit. A risk-based scoring approach (e.g., combining CVSS, asset criticality, threat intel) would shrink the true “critical” list and accelerate real fixes. Option B and D are operational issues, but the root cause is poor prioritization logic.

Correct Answer: C

The attack path combined phishing (initial access) with zerologon (privilege escalation). Patching domain controllers against CVE-2020-1474 directly breaks the escalation phase. Tracking the patch coverage via authenticated scans provides a clear, objective metric that the vulnerability is being eliminated. MTTD (B) measures detection speed but not remediation; disabled training modules (A) are irrelevant; and a raw count of findings (D) does not specify whether the particular attack path is fixed.

Correct Answer: B

The policy mandates level 2, which adds physical tamper-evidence and role-based authentication; level 1 provides only the cryptographic algorithm validation. Because the module is used to protect stored passwords, the failure to meet the higher level is a shortfall in a technical (cryptographic) control, not administrative or purely physical. It is not a false-positive (D) because the explicit requirement is level 2.

Correct Answer: B

ISO 27001 auditors look for repeatable, documented evidence that each control is operating effectively. Choice B supplies a single artifact (the test-to-control matrix) that links every control to an auditable test procedure, evidence of execution, and accountability. Vulnerability scans (A) and pen-test reports (C) cover only a subset of technical controls, while a risk heat map (D) shows risk posture, not control effectiveness.

Correct Answer: B

ISO 19011 clause 5.2 requires understanding the context and risk environment before scoping the audit program. Legislation drives privacy risk, so it must be documented first to determine which processes, controls, and entities to audit. Budget (A) and sampling (D) come later; auditor certification (C) is not mandated by 19011.

Correct Answer: C

ISO 27001 requires that the SoA list every Annex A control and justify inclusion or exclusion. A control design assessment (gap analysis) systematically compares each control’s intended design with the standard, revealing missing or incorrectly scoped controls before the certification audit. Vulnerability scans (A) and red-team tests (D) evaluate technical effectiveness, not design coverage, while supplier questionnaires (B) address third-party risk, not the retailer's own SoA.

Correct Answer: A

AWS Config conformance packs contain pre-written rules that map 1-to-1 to CIS Benchmark items. Config allows “override” annotations where an auditor can exempt a finding and attach justification, turning the result into a KPI metric. CloudTrail (B) is API logging, not configuration compliance scoring. GuardDuty (C) is threat detection, not baseline hardening. Trusted Advisor (D) has some overlap but is not benchmark-specific and lacks granular exemption workflow.

Correct Answer: B

Continuous monitoring tools must first be proven accurate. A parallel-run compares the new automated reconciliation with the existing trusted manual process for the same population, quantifying false positives/negatives before full adoption. Benchmarking (A) or vendor certification (D) addresses design or supply-chain risk, not operational accuracy. Red-teaming APIs (C) evaluates security of the tool, not its data integrity.

Correct Answer: B

IAST instruments the running code and correlates runtime findings with source context, producing higher-fidelity results than pure DAST and fewer false positives than SAST alone. Manual reviews (A) are too slow for per-merge gating, quarterly pen tests (C) are point-in-time, and awareness slides (D) do not provide automated assurance.

Correct Answer: C

Active testing (packet injection) empirically proves that no forwarding path exists. Configuration reviews (A) and interviews (D) are useful but cannot guarantee the running state matches the intended design. Diagram observation (B) is purely documentary.

Correct Answer: C

The failure is procedural—threat modeling was required but skipped. A process audit (C) comparing change tickets to policy would reveal that the “minor” classification was inappropriate. Code review (A) or static analysis (B) might find the vulnerability but would not confirm whether threat modeling occurred. Dynamic scanning (D) is too late and may not pinpoint deserialization without tailored payloads.

Correct Answer: B

CSPM tools consume cloud APIs to retrieve resource configurations in real time and can be event-driven, giving immediate feedback when a container with “Restricted” data lacks the required encryption settings. CMDB (A) lags behind ephemeral assets, manual checks (C) do not scale, and social engineering (D) is irrelevant.

Correct Answer: B

SOC 2 Type II requires evidence that controls operate effectively throughout the period. Selecting terminated customers and tracing their backup-deletion evidence (tickets plus automated S3 lifecycle logs) directly tests whether the 30-day retention control is working. KMS rotation (A) concerns key management, not deletion timing; unit tests (C) are developmental; and a risk-register review (D) is design-only.

Correct Answer: D

The team documented that the control exists (C) and is configured (accuracy, A), but they did not evaluate whether it actually mitigates modern password attacks (effectiveness, D). The absence of breached-password screening and the 24-hour window reduce real-world protection, demonstrating ineffectiveness.

Correct Answer: B

The 2FA API was presumed decommissioned but was still live—indicating a gap in configuration management or change-control validation. Security metrics (A) might have shown the gap had they existed, but the root cause is operational visibility, not measurement. Incident response (C) is reactive, and static code review (D) would not surface an API that should already be offline.

Correct Answer: A

Continuous monitoring with verifiable, tamper-evident data gives the auditor substantive evidence that controls operated throughout the period, directly supporting the availability criteria. Incident tickets (B) are reactive evidence, quarterly tests (C) are point-in-time, and a self-assessment (D) lacks independence and rigor.

Correct Answer: B

SOC 2 reports provide a basis but not a blanket transfer of risk; customers must perform their own vendor-risk mapping and decide whether the noted change-management issues affect their environment. Sharing under NDA (A) is true but not the “best” limitation. An unqualified opinion does not eliminate customer due diligence (C), and “matters of substance” are disclosed weaknesses, not an opinion modifier (D).

Correct Answer: C

Objectivity requires that findings be rated without undue influence. Arbitrary re-categorization to keep the KPI green compromises objectivity. Independence (A) relates to organizational reporting lines, accuracy (B) to correct data, and relevance (D) to whether the metric matters—none of which are the primary issue here.

Correct Answer: B

Automating IAM Access Analyzer via Lambda driven by EventBridge provides near-real-time detection of resource policies that grant public or cross-account access. It is continuous, programmatic, and far more frequent than weekly (A), quarterly (C), or annual (D) activities.

Correct Answer: A

There is substantial overlap between Annex A and 800-171. Creating a combined control matrix allows one set of test procedures to generate evidence acceptable for both standards, conserving resources while still meeting each framework’s unique requirements. Separate audits (B) double the workload; outsourcing (C) is cost-effective but does not reduce test duplication; and ISO 27017 (D) is cloud-specific and not a substitute for 800-171 CUI protections.

Correct Answer: B

Duplicate submissions of the same underlying flaw inflate bounty costs and skew metrics. Defect duplication rate (B) measures how often the same vulnerability is reported multiple times. MTTD (A) gauges detection speed, false positives (C) measure incorrect findings, and patch latency (D) measures fix speed—none capture the “same bug, many reports” problem.

Correct Answer: A

Verifiability means a different competent team could replicate the findings using the same methodology and data. Objectivity (B) is related but focuses on bias-free presentation. Timeliness (C) and clarity (D) are desirable but do not address reproducibility.

Correct Answer: B

Anonymous voting plus data-driven pre-work minimizes groupthink and social-desirability bias, producing more honest self-assessments. A Likert scale (A) still allows inflated scoring, merely with more granularity. While IA presentations (C) and control narratives (D) help, they do not eliminate the pressure to conform that anonymity addresses.

Correct Answer: D

Automated, population-wide validation of every vswitch and host rule against actual flow attempts proves that no unauthorized path exists. Sampling (B) or one-time exports (A) can miss misconfigurations, while white papers (C) are marketing artifacts, not evidence of operational effectiveness.

Correct Answer: A

An end-to-end test (generate event → log → SIEM alert) provides operational assurance. A controlled scan from a known bastion host against a non-critical test instance produces real flow logs and verifies alert firing without harming production workloads. Terraform inspection (B) is design-only; table-top exercises (C) are discussion-based; GuardDuty (D) uses threat-intel, not flow-log ingestion, so it does not test the company’s custom SIEM alerting logic.

Correct Answer: C

Information Disclosure in STRIDE maps directly to ensuring sensitive data is not exposed in unexpected channels such as logs, backups, or inter-process communication. Static and dynamic analysis can instrument the app to detect such leaks. A focuses on Spoofing/Tampering, B on Denial of Service, and D on Tampering again.

Correct Answer: B

Regulatory language for “independent” customarily means organizational independence from the team that built the system, which an external certified firm satisfies. Limiting scope to the Top 10 keeps cost contained while still meeting the letter and spirit of the requirement. Option A leaves the actual testing in the hands of the interested party; internal audit review is better than nothing but is not technically independent testing. Peer review (C) and dual sign-off (D) are good practices but do not constitute an independent security assessment in the regulatory sense.

Correct Answer: B

Direct observation (on-site inspection) of HSM segmentation provides first-hand evidence that cannot be fully corroborated by a third-party report (A), an internal pen-test (C), or a self-reported questionnaire (D). The right-to-audit clause makes this feasible.

Correct Answer: B

Because the devices are black boxes and under vendor warranty, intrusive testing (A or C) could void support or disrupt clinical operations. The safest, most reliable evidence comes from comparing the manufacturer’s software bill of materials (SBOM) and published patches against actual firmware versions observed on randomly sampled devices—an accepted non-invasive audit technique.