CISSP Security Assessment 5 — Questions and Answers
Question 1: A penetration tester successfully gains domain administrator privileges during an internal test. What should be the tester's immediate next step?
- Continue exploiting other systems to demonstrate full domain compromise
- Document the finding, notify the client per the rules of engagement, and await guidance (Correct answer)
- Delete evidence of the compromise to test incident response
- Create a persistent backdoor to demonstrate long-term risk
Correct answer: Document the finding, notify the client per the rules of engagement, and await guidance
Upon achieving a significant objective like domain admin, testers must document findings immediately and notify the client per agreed-upon escalation procedures in the rules of engagement.
Question 2: Which threat modeling methodology uses an attacker-centric approach organized around four categories: Goals, Observations, Plan, and Actions?
- STRIDE
- PASTA (Correct answer)
- DREAD
- VAST
Correct answer: PASTA
PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling framework that aligns attacker motivations with business objectives across seven stages.
Question 3: During an assessment, a tester intercepts network traffic and finds credentials transmitted in cleartext. Which control failure does this primarily demonstrate?
- Lack of multi-factor authentication
- Absence of encryption for data in transit (Correct answer)
- Weak password policy
- Insufficient logging and monitoring
Correct answer: Absence of encryption for data in transit
Cleartext credential transmission indicates the absence of transport encryption (such as TLS), which is required to protect data in transit from interception.
Question 4: What is the purpose of a 'tiger team' in the context of security assessments?
- A team that only performs compliance audits
- A group of security experts authorized to conduct aggressive, goal-based offensive testing (Correct answer)
- An incident response team that handles active breaches
- A team responsible for patch management
Correct answer: A group of security experts authorized to conduct aggressive, goal-based offensive testing
A tiger team is a specialized group authorized to conduct adversarial testing using any means necessary to achieve defined objectives, simulating advanced threat actors.
Question 5: An organization wants to continuously identify new vulnerabilities as systems change rather than relying solely on periodic assessments. Which approach supports this goal?
- Annual penetration testing
- Continuous vulnerability management with automated scanning (Correct answer)
- Quarterly compliance audits
- Biannual red team exercises
Correct answer: Continuous vulnerability management with automated scanning
Continuous vulnerability management uses automated, recurring scans integrated with asset inventory to detect new vulnerabilities as environments evolve.
Question 6: Which artifact should a penetration test final report always include to help the organization act on findings effectively?
- Detailed exploit code for all vulnerabilities
- An executive summary and a prioritized remediation roadmap (Correct answer)
- The tester's personal risk opinions
- Raw scanner output without analysis
Correct answer: An executive summary and a prioritized remediation roadmap
A quality penetration test report includes an executive summary for leadership and a technical remediation roadmap prioritized by risk to guide the security team's response.
Question 7: Which OWASP tool is commonly used during web application security assessments as an intercepting proxy to analyze and manipulate HTTP/HTTPS traffic?
- Nessus
- Burp Suite (Correct answer)
- Nmap
- Metasploit
Correct answer: Burp Suite
Burp Suite is the de facto standard web application security testing proxy used to intercept, inspect, and manipulate HTTP/HTTPS traffic during assessments.
CISSP Security Assessment 5
A penetration tester successfully gains domain administrator privileges during an internal test.
What should be the tester's immediate next step?