CISSP Security Assessment 2 — Questions and Answers
Question 1: During a penetration test, a tester discovers a critical vulnerability but the engagement scope explicitly excludes the affected system. What should the tester do?
- Exploit the vulnerability to demonstrate impact
- Immediately report the finding to the client and halt testing on that system (Correct answer)
- Ignore it since it is out of scope
- Expand the scope unilaterally to include the system
Correct answer: Immediately report the finding to the client and halt testing on that system
The tester must report out-of-scope findings to the client immediately without exploiting them, as the rules of engagement govern what systems can be tested.
Question 2: Which vulnerability scanning technique sends crafted packets and analyzes responses to determine open ports and services without authenticating to the target?
- Credentialed scanning
- Passive scanning
- Active scanning (Correct answer)
- Agent-based scanning
Correct answer: Active scanning
Active scanning sends probes to targets and analyzes responses to discover open ports, services, and potential vulnerabilities without requiring credentials.
Question 3: A security assessor finds that an organization rates all vulnerabilities as 'Critical' regardless of actual risk. Which CVSS component is the organization likely ignoring?
- Base Score
- Temporal Score
- Environmental Score (Correct answer)
- Attack Vector
Correct answer: Environmental Score
The Environmental Score adjusts the CVSS base score based on the organization's specific environment, asset criticality, and existing controls, enabling contextualized risk ratings.
Question 4: What is the primary purpose of conducting a gap analysis during a security assessment?
- To identify zero-day vulnerabilities
- To compare current security posture against a target framework or standard (Correct answer)
- To test employee phishing susceptibility
- To enumerate all network assets
Correct answer: To compare current security posture against a target framework or standard
A gap analysis compares the organization's current security controls and practices against a target baseline such as NIST CSF or ISO 27001 to identify deficiencies.
Question 5: Which type of assessment involves authorized simulated attacks that replicate tactics of real-world threat actors to test detection and response capabilities?
- Vulnerability assessment
- Red team exercise (Correct answer)
- Compliance audit
- Risk assessment
Correct answer: Red team exercise
Red team exercises use adversary simulation techniques to test an organization's people, processes, and technology against realistic attack scenarios.
Question 6: An assessor wants to determine which vulnerabilities pose the greatest risk to the business. Which process combines vulnerability data with threat intelligence and asset criticality?
- Vulnerability scanning
- Risk-based vulnerability management (Correct answer)
- Patch management
- Security benchmarking
Correct answer: Risk-based vulnerability management
Risk-based vulnerability management prioritizes vulnerabilities by correlating scanner findings with threat intelligence, exploit availability, and business asset value.
Question 7: During a web application assessment, a tester identifies that user-supplied input is reflected in HTTP response headers without sanitization. What vulnerability class does this represent?
- SQL Injection
- HTTP Header Injection (Correct answer)
- Cross-Site Request Forgery
- XML External Entity
Correct answer: HTTP Header Injection
HTTP Header Injection occurs when unsanitized user input is embedded in response headers, potentially enabling response splitting or cache poisoning attacks.
CISSP Security Assessment 2
During a penetration test, a tester discovers a critical vulnerability but the engagement scope explicitly excludes the affected system.
What should the tester do?