CISSP Security Assessment 4 — Questions and Answers
Question 1: Which phase of a penetration test involves gathering publicly available information about the target without directly interacting with its systems?
- Scanning
- Exploitation
- Passive reconnaissance (Correct answer)
- Post-exploitation
Correct answer: Passive reconnaissance
Passive reconnaissance (OSINT) collects information from public sources like WHOIS, DNS records, and social media without sending traffic to the target.
Question 2: A CISSP is reviewing an assessment report that lists 200 vulnerabilities. Which approach should the organization prioritize?
- Patch all vulnerabilities simultaneously
- Prioritize based on risk score combining exploitability, impact, and asset criticality (Correct answer)
- Address vulnerabilities alphabetically by CVE ID
- Fix only Critical CVSS scores and ignore the rest
Correct answer: Prioritize based on risk score combining exploitability, impact, and asset criticality
Effective remediation prioritizes vulnerabilities by combining exploitability likelihood, potential business impact, and the criticality of the affected asset.
Question 3: During a social engineering assessment, a tester calls an employee pretending to be from IT support and convinces them to reset their password. What type of attack does this represent?
- Phishing
- Vishing (Correct answer)
- Smishing
- Spear phishing
Correct answer: Vishing
Vishing (voice phishing) uses telephone calls to manipulate victims into revealing sensitive information or performing actions that compromise security.
Question 4: What does the term 'attack surface' represent in the context of security assessments?
- The geographic area where an attack occurred
- The total set of entry points an attacker can use to compromise a system (Correct answer)
- The severity rating assigned to a discovered vulnerability
- The number of security controls currently in place
Correct answer: The total set of entry points an attacker can use to compromise a system
The attack surface encompasses all exposed interfaces, APIs, services, and pathways through which unauthorized access could be gained.
Question 5: An organization conducts quarterly vulnerability scans but has never performed a penetration test. What critical gap does this create?
- Vulnerability scans identify too many false positives
- Scans identify weaknesses but cannot demonstrate the actual exploitability or chained attack paths (Correct answer)
- Penetration tests are required by all compliance standards
- Scans cannot run on Windows systems
Correct answer: Scans identify weaknesses but cannot demonstrate the actual exploitability or chained attack paths
Penetration tests validate whether identified vulnerabilities are actually exploitable and reveal multi-step attack chains that scanners cannot simulate.
Question 6: Which concept describes the practice of re-scanning or retesting systems after remediation to confirm vulnerabilities have been successfully addressed?
- Continuous monitoring
- Verification testing (Correct answer)
- Threat modeling
- Baseline scanning
Correct answer: Verification testing
Verification testing (also called remediation verification) confirms that patching or configuration changes have successfully closed the identified vulnerabilities.
Question 7: What is the key difference between a security audit and a security assessment?
- Audits are performed by internal teams; assessments are always external
- Audits measure compliance against defined standards; assessments evaluate overall security posture and risk (Correct answer)
- Assessments only cover technical controls; audits only cover people and process
- Audits are more expensive than assessments
Correct answer: Audits measure compliance against defined standards; assessments evaluate overall security posture and risk
Security audits verify adherence to specific standards or policies, while assessments take a broader view to identify risks, gaps, and improvement opportunities.
CISSP Security Assessment 4
Which phase of a penetration test involves gathering publicly available information about the target without directly interacting with its systems?