CISSP Security Assessment 2

Question 1

During a penetration test, a tester discovers a critical vulnerability but the engagement scope explicitly excludes the affected system. What should the tester do?

Accepted Answer

Immediately report the finding to the client and halt testing on that system

Answer

The tester must report out-of-scope findings to the client immediately without exploiting them, as the rules of engagement govern what systems can be tested.

Question 2

Which vulnerability scanning technique sends crafted packets and analyzes responses to determine open ports and services without authenticating to the target?

Accepted Answer

Active scanning

Answer

Active scanning sends probes to targets and analyzes responses to discover open ports, services, and potential vulnerabilities without requiring credentials.

Question 3

A security assessor finds that an organization rates all vulnerabilities as 'Critical' regardless of actual risk. Which CVSS component is the organization likely ignoring?

Accepted Answer

Environmental Score

Answer

The Environmental Score adjusts the CVSS base score based on the organization's specific environment, asset criticality, and existing controls, enabling contextualized risk ratings.

Question 4

What is the primary purpose of conducting a gap analysis during a security assessment?

Accepted Answer

To compare current security posture against a target framework or standard

Answer

A gap analysis compares the organization's current security controls and practices against a target baseline such as NIST CSF or ISO 27001 to identify deficiencies.

Question 5

Which type of assessment involves authorized simulated attacks that replicate tactics of real-world threat actors to test detection and response capabilities?

Accepted Answer

Red team exercise

Answer

Red team exercises use adversary simulation techniques to test an organization's people, processes, and technology against realistic attack scenarios.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security Assessment 2