CISSP Security Assessment 5

Question 1

A penetration tester successfully gains domain administrator privileges during an internal test. What should be the tester's immediate next step?

Accepted Answer

Document the finding, notify the client per the rules of engagement, and await guidance

Answer

Upon achieving a significant objective like domain admin, testers must document findings immediately and notify the client per agreed-upon escalation procedures in the rules of engagement.

Question 2

Which threat modeling methodology uses an attacker-centric approach organized around four categories: Goals, Observations, Plan, and Actions?

Accepted Answer

PASTA

Answer

PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling framework that aligns attacker motivations with business objectives across seven stages.

Question 3

During an assessment, a tester intercepts network traffic and finds credentials transmitted in cleartext. Which control failure does this primarily demonstrate?

Accepted Answer

Absence of encryption for data in transit

Answer

Cleartext credential transmission indicates the absence of transport encryption (such as TLS), which is required to protect data in transit from interception.

Question 4

What is the purpose of a 'tiger team' in the context of security assessments?

Accepted Answer

A group of security experts authorized to conduct aggressive, goal-based offensive testing

Answer

A tiger team is a specialized group authorized to conduct adversarial testing using any means necessary to achieve defined objectives, simulating advanced threat actors.

Question 5

An organization wants to continuously identify new vulnerabilities as systems change rather than relying solely on periodic assessments. Which approach supports this goal?

Accepted Answer

Continuous vulnerability management with automated scanning

Answer

Continuous vulnerability management uses automated, recurring scans integrated with asset inventory to detect new vulnerabilities as environments evolve.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security Assessment 5