(ISC)² CISSP Security Assessment and Testing Practice Questions

Free CISSP Security Assessment and Testing practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main (ISC)² CISSP page. Sign up free to practice the full set.

1. Question 1Security Assessment and Testing

   What is the purpose of a vulnerability assessment versus a penetration test?

   • AA vulnerability assessment identifies/prioritizes weaknesses broadly; a penetration test attempts to exploit them to demonstrate impactCorrect
   • BA vulnerability assessment actively exploits every weakness it finds, while a penetration test only produces a passive list of them
   • CBoth are identical activities that differ only in what the resulting report is named for the client's records
   • DA penetration test only enumerates open network ports and never attempts to exploit any discovered weakness
   ✓ Correct answer: A

   A vulnerability assessment casts a wide net to discover and rank weaknesses across the environment without necessarily exploiting them, giving broad coverage. A penetration test goes further by actively exploiting selected findings to prove real-world impact and chained attack paths. The two are complementary: breadth of discovery versus depth of demonstrated exploitability, and mature programs use both at appropriate points.

   Why the other options are wrong

   • BThis reverses the roles: exploitation is the penetration test's job, while the assessment discovers and prioritizes without exploiting.
   • CThey are distinct activities differing in depth and intent, not merely the label on the report.
   • DPort enumeration is only an early step; a penetration test goes on to exploit weaknesses to show impact.
2. Question 2Security Assessment and Testing

   Which software test technique injects malformed, unexpected, or random inputs to discover crashes and unhandled conditions?

   • AFuzz testing (fuzzing)Correct
   • BRegression testing
   • CMisuse-case documentation review
   • DUser acceptance testing (UAT)
   ✓ Correct answer: A

   Fuzz testing feeds malformed, unexpected, or randomly generated inputs into an application to trigger crashes, memory errors, and unhandled edge cases that structured testing would not think to try. Regression testing instead re-runs known test cases after a change, misuse-case review is a design-time documentation exercise, and user acceptance testing validates that finished functionality meets business requirements, none of which involve injecting malformed input to find defects.

   Why the other options are wrong

   • BRegression testing re-runs existing known test cases after a change; it does not inject novel malformed input.
   • CMisuse-case review is a documentation exercise performed at design time, not runtime input injection.
   • DUAT validates that finished functionality meets business requirements; it does not target malformed input handling.
3. Question 3Security Assessment and Testing

   An auditor is examining a service organization that processes payroll on behalf of many client companies. The clients want assurance that controls are not only suitably designed but also operated effectively over a defined period. Which report is MOST appropriate to request?

   • ASOC 1 Type I report
   • BSOC 2 Type II reportCorrect
   • CSOC 3 report
   • DPCI DSS Attestation of Compliance
   ✓ Correct answer: B

   SOC 2 reports address security, availability, processing integrity, confidentiality, and privacy under the Trust Services Criteria, and a Type II engagement tests whether controls operated effectively over a review period, typically 6-12 months, rather than at one point in time. This gives client organizations the period-of-time assurance they need. A Type I, by contrast, opines only on control design as of a single date.

   Why the other options are wrong

   • AA SOC 1 Type I report covers financial-reporting controls and attests only to design at a point in time, not operating effectiveness.
   • CA SOC 3 report is a general-use, summarized attestation lacking the detailed control descriptions and tests clients need.
   • DA PCI DSS AOC addresses cardholder data protection, not the broad operational controls of a payroll service provider.
4. Question 4Security Assessment and Testing

   During code review, a security analyst examines source code line-by-line without running the program to find insecure functions and logic flaws. Which testing approach is this?

   • AStatic application security testing (SAST)Correct
   • BDynamic application security testing (DAST)
   • CInteractive application security testing (IAST)
   • DRuntime application self-protection (RASP)
   ✓ Correct answer: A

   SAST inspects source code, bytecode, or binaries in a non-running (static) state to find insecure coding patterns, dangerous function calls, and logic flaws early in the lifecycle. Because it does not execute the program, it can examine code paths that may be hard to reach at runtime, though it is prone to false positives.

   Why the other options are wrong

   • BDAST tests a running application from the outside by sending inputs and observing responses; it does not read source code.
   • CIAST instruments a running application to combine internal visibility with live traffic, so it requires execution rather than purely static inspection.
   • DRASP is a protection technology that detects and blocks attacks inside a running application at runtime; it is not a code-review testing method.
5. Question 5Security Assessment and Testing

   During code review, an analyst examines an application's source code without executing it, using a tool that traces data flow from input sources to sensitive sinks. Which testing technique is being described?

   • AStatic application security testing (SAST)Correct
   • BDynamic application security testing (DAST)
   • CInteractive application security testing (IAST)
   • DRuntime application self-protection (RASP)
   ✓ Correct answer: A

   SAST is a white-box technique that inspects source code, bytecode, or binaries without running the application, performing data-flow and taint analysis from sources (user input) to sinks (queries, commands). Because it does not execute the program, it can be run early in development and find flaws before deployment. The other options all require the application to be running.

   Why the other options are wrong

   • BDAST tests a running application from the outside (black-box) by sending requests, so it does not analyze static source code.
   • CIAST instruments a running application with agents and observes behavior during execution, so it is not purely static.
   • DRASP is a protection technology that blocks attacks at runtime; it is a defensive control, not a code-analysis testing technique.
6. Question 6Security Assessment and Testing

   During a code review, an analyst examines an application's source code line by line without executing it to find insecure functions and tainted data flows. Which testing approach is being used?

   • ADynamic application security testing (DAST)
   • BInteractive application security testing (IAST)
   • CStatic application security testing (SAST)Correct
   • DRuntime application self-protection (RASP)
   ✓ Correct answer: C

   SAST analyzes source code, bytecode, or binaries at rest, tracing data flows and flagging insecure constructs early in the development lifecycle. Because it does not require a running application, it can be applied as soon as code is written, enabling shift-left detection.

   Why the other options are wrong

   • ADAST tests a running application from the outside by sending inputs and observing responses, so it requires execution.
   • BIAST instruments a running application to observe code behavior during testing, which also requires execution.
   • DRASP is a protective runtime control that detects and blocks attacks in production, not a code-review technique.
7. Question 7Security Assessment and TestingSelect all that apply

   A CISO is building a security metrics dashboard and must correctly separate key performance indicators from key risk indicators. Which TWO statements correctly characterize KPIs and KRIs? (Choose two.)

   • AA KPI measures how well a security activity is performing, such as the percentage of systems patched within the SLACorrect
   • BA KRI is a forward-looking signal that risk exposure is increasing, such as a rising number of unremediated critical vulnerabilitiesCorrect
   • CKPIs and KRIs are interchangeable terms for the same backward-looking financial measure
   • DA KRI can only be reported after a security incident has already caused a loss
   ✓ Correct answer: A, B

   A key performance indicator measures the effectiveness or efficiency of an activity, such as patch-within-SLA rates. A key risk indicator is a forward-looking metric that warns when risk exposure is trending upward, such as a growing backlog of unremediated critical vulnerabilities, giving management time to act before a loss occurs.

   Why the other options are wrong

   • CKPIs and KRIs serve different purposes and are not interchangeable, and KRIs are leading rather than purely backward-looking.
   • DA KRI is specifically designed to be a leading indicator that flags rising risk before an incident, not only after a loss.
8. Question 8Security Assessment and Testing

   A security team wants to validate its incident response plan by walking key stakeholders through a simulated ransomware scenario in a conference room, without touching production systems or failing over to the alternate site. Which disaster recovery test type is this?

   • AFull-interruption test
   • BTabletop exerciseCorrect
   • CParallel test
   • DSimulation test with partial failover
   ✓ Correct answer: B

   In a tabletop exercise, stakeholders talk through their roles and decisions against a scenario to find gaps in the plan. No systems are activated, no failover occurs, and production is untouched, which matches the description exactly. It is the lowest-impact DR test and typically the first step before more disruptive tests.

   Why the other options are wrong

   • AA full-interruption test halts production and cuts over to the recovery site, the highest-risk and most disruptive test.
   • CA parallel test brings the recovery site online alongside production to compare results; it activates real systems.
   • DA simulation with partial failover activates some recovery capabilities, exceeding a purely discussion-based walkthrough.

How Security Assessment and Testing is tested

This domain holds 130 of the 1,117 questions in the CISSP bank, about 12%. The mix is 109 single-answer multiple choice and 21 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Assessment and Testing on its own rather than re-running full-length mocks.

Other CISSP exam domains

• Security and Risk Management172 questions
• Asset Security109 questions
• Security Architecture and Engineering141 questions
• Communication and Network Security138 questions
• Identity and Access Management138 questions
• Security Operations157 questions
• Software Development Security132 questions
• All CISSP practice questions1,117 total
• Security Assessment and Testing study notesKey concepts
• Security practice examsAll Security

CISSP Security Assessment and Testing FAQ