CISSP Security Assessment 3 — Questions and Answers
Question 1: What distinguishes a white-box penetration test from a black-box penetration test?
- White-box tests are performed externally; black-box tests are performed internally
- White-box testers are given full knowledge of the environment; black-box testers receive no prior information (Correct answer)
- White-box tests focus on networks; black-box tests focus on applications
- White-box tests use automated tools; black-box tests are fully manual
Correct answer: White-box testers are given full knowledge of the environment; black-box testers receive no prior information
White-box testing provides the tester with full knowledge including source code and architecture, while black-box testing simulates an external attacker with no prior information.
Question 2: Which document formally authorizes a penetration test and protects the tester from legal liability?
- Statement of Work
- Non-Disclosure Agreement
- Rules of Engagement
- Authorization to Test / Permission to Attack letter (Correct answer)
Correct answer: Authorization to Test / Permission to Attack letter
An Authorization to Test letter (also called Permission to Attack) is signed by an authorized representative and explicitly grants legal permission to conduct the penetration test.
Question 3: A company wants to assess whether employees follow clean desk and physical security policies. Which assessment technique is most appropriate?
- Network vulnerability scan
- Physical security walkthrough / inspection (Correct answer)
- Social engineering phone call
- Web application penetration test
Correct answer: Physical security walkthrough / inspection
A physical security walkthrough allows assessors to directly observe and document compliance with policies like clean desk, visitor management, and access control.
Question 4: In the context of security assessments, what does 'pivoting' refer to during a penetration test?
- Changing the test methodology mid-engagement
- Using a compromised system as a launching point to attack other internal systems (Correct answer)
- Switching from automated to manual testing
- Rotating through different vulnerability categories
Correct answer: Using a compromised system as a launching point to attack other internal systems
Pivoting uses an already-compromised host as an intermediary to reach and attack systems in network segments that would otherwise be inaccessible.
Question 5: Which NIST publication provides a framework for conducting security and privacy risk assessments for federal information systems?
- NIST SP 800-53
- NIST SP 800-30 (Correct answer)
- NIST SP 800-61
- NIST SP 800-137
Correct answer: NIST SP 800-30
NIST SP 800-30 provides guidance for conducting risk assessments, including preparing for, conducting, communicating, and maintaining risk assessment results.
Question 6: A security assessment reveals that a web server is running an outdated TLS 1.0 configuration. Under CVSS v3.1, which metric would reflect that an attacker must be on the same network segment to exploit this?
- Attack Complexity: High
- Attack Vector: Adjacent (Correct answer)
- Privileges Required: Low
- User Interaction: Required
Correct answer: Attack Vector: Adjacent
The CVSS Attack Vector metric 'Adjacent' indicates exploitation requires the attacker to be on the same shared network, such as Bluetooth, RF, or local subnet.
Question 7: What is the main advantage of using automated vulnerability scanners combined with manual verification during an assessment?
- Automation eliminates all false positives
- Manual verification confirms true positives and identifies complex logic flaws scanners miss (Correct answer)
- Manual testing is faster than automated scanning
- Automation provides legal authorization for testing
Correct answer: Manual verification confirms true positives and identifies complex logic flaws scanners miss
Automated scanners efficiently enumerate known vulnerabilities but produce false positives and miss business logic flaws, which manual verification addresses.
CISSP Security Assessment 3
What distinguishes a white-box penetration test from a black-box penetration test?