CISSP Security Assessment 4

Question 1

Which phase of a penetration test involves gathering publicly available information about the target without directly interacting with its systems?

Accepted Answer

Passive reconnaissance

Answer

Passive reconnaissance (OSINT) collects information from public sources like WHOIS, DNS records, and social media without sending traffic to the target.

Question 2

A CISSP is reviewing an assessment report that lists 200 vulnerabilities. Which approach should the organization prioritize?

Accepted Answer

Prioritize based on risk score combining exploitability, impact, and asset criticality

Answer

Effective remediation prioritizes vulnerabilities by combining exploitability likelihood, potential business impact, and the criticality of the affected asset.

Question 3

During a social engineering assessment, a tester calls an employee pretending to be from IT support and convinces them to reset their password. What type of attack does this represent?

Accepted Answer

Vishing

Answer

Vishing (voice phishing) uses telephone calls to manipulate victims into revealing sensitive information or performing actions that compromise security.

Question 4

What does the term 'attack surface' represent in the context of security assessments?

Accepted Answer

The total set of entry points an attacker can use to compromise a system

Answer

The attack surface encompasses all exposed interfaces, APIs, services, and pathways through which unauthorized access could be gained.

Question 5

An organization conducts quarterly vulnerability scans but has never performed a penetration test. What critical gap does this create?

Accepted Answer

Scans identify weaknesses but cannot demonstrate the actual exploitability or chained attack paths

Answer

Penetration tests validate whether identified vulnerabilities are actually exploitable and reveal multi-step attack chains that scanners cannot simulate.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security Assessment 4