CGRC Security Assessment 2 — Questions and Answers
Question 1: Which penetration testing methodology specifically maps attack techniques to defensive controls using a structured knowledge base?
- PTES
- MITRE ATT&CK (Correct answer)
- OWASP Testing Guide
- NIST SP 800-115
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques used to map attacks to defensive controls.
Question 2: A security assessor is evaluating an organization's web application. Which technique involves sending unexpected input to test for injection vulnerabilities?
- Port scanning
- Fuzzing (Correct answer)
- Banner grabbing
- War dialing
Correct answer: Fuzzing
Fuzzing involves sending unexpected, malformed, or random data inputs to an application to discover vulnerabilities like injection flaws.
Question 3: Under NIST SP 800-53, which control family is primarily responsible for security assessment and authorization activities?
- SI - System and Information Integrity
- CA - Assessment, Authorization, and Monitoring (Correct answer)
- RA - Risk Assessment
- PL - Planning
Correct answer: CA - Assessment, Authorization, and Monitoring
The CA (Assessment, Authorization, and Monitoring) control family in NIST SP 800-53 covers security assessments, authorization, and continuous monitoring.
Question 4: What is the primary purpose of a System Security Plan (SSP) in the context of security assessments?
- To document system vulnerabilities discovered during testing
- To provide an overview of security requirements and controls implemented (Correct answer)
- To record security incidents affecting the system
- To authorize penetration testing activities
Correct answer: To provide an overview of security requirements and controls implemented
An SSP documents the security requirements for an information system and describes how controls are implemented to meet those requirements.
Question 5: During a security assessment, an assessor discovers that a critical patch has not been applied but the organization has documented compensating controls. What should the assessor do?
- Mark the finding as compliant since compensating controls exist
- Document the vulnerability and evaluate whether compensating controls adequately mitigate the risk (Correct answer)
- Escalate directly to regulators without further evaluation
- Recommend immediate shutdown of the affected system
Correct answer: Document the vulnerability and evaluate whether compensating controls adequately mitigate the risk
Assessors must document findings and evaluate whether compensating controls sufficiently reduce risk to an acceptable level rather than automatically marking items compliant.
Question 6: Which type of assessment involves evaluating security controls without prior knowledge of the system's architecture or configuration?
- White-box assessment
- Gray-box assessment
- Black-box assessment (Correct answer)
- Crystal-box assessment
Correct answer: Black-box assessment
Black-box assessments simulate an external attacker with no prior knowledge of the target system's internals, architecture, or configuration.
Question 7: What does CVSS Base Score measure in the context of vulnerability assessment?
- The likelihood that a vulnerability will be exploited in the next 30 days
- The intrinsic severity of a vulnerability independent of time or environment (Correct answer)
- The financial impact of a successful exploitation
- The number of systems affected by a vulnerability
Correct answer: The intrinsic severity of a vulnerability independent of time or environment
The CVSS Base Score represents the intrinsic characteristics of a vulnerability that are constant over time and across environments.
CGRC Security Assessment 2
Which penetration testing methodology specifically maps attack techniques to defensive controls using a structured knowledge base?