CISSP Security Assessment 3

Question 1

What distinguishes a white-box penetration test from a black-box penetration test?

Accepted Answer

White-box testers are given full knowledge of the environment; black-box testers receive no prior information

Answer

White-box testing provides the tester with full knowledge including source code and architecture, while black-box testing simulates an external attacker with no prior information.

Question 2

Which document formally authorizes a penetration test and protects the tester from legal liability?

Accepted Answer

Authorization to Test / Permission to Attack letter

Answer

An Authorization to Test letter (also called Permission to Attack) is signed by an authorized representative and explicitly grants legal permission to conduct the penetration test.

Question 3

A company wants to assess whether employees follow clean desk and physical security policies. Which assessment technique is most appropriate?

Accepted Answer

Physical security walkthrough / inspection

Answer

A physical security walkthrough allows assessors to directly observe and document compliance with policies like clean desk, visitor management, and access control.

Question 4

In the context of security assessments, what does 'pivoting' refer to during a penetration test?

Accepted Answer

Using a compromised system as a launching point to attack other internal systems

Answer

Pivoting uses an already-compromised host as an intermediary to reach and attack systems in network segments that would otherwise be inaccessible.

Question 5

Which NIST publication provides a framework for conducting security and privacy risk assessments for federal information systems?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 provides guidance for conducting risk assessments, including preparing for, conducting, communicating, and maintaining risk assessment results.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security Assessment 3