CISSP Security Assessment and Testing: 144 practice questions

12 of the 144 Security Assessment and Testing questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Use the approved: Which approach best resolves the conflicting requirements?

1. Replace the assessment with interviews about substations’ patching procedures.

   Interviews can describe procedures but cannot provide equivalent technical evidence of installed patch status.
2. Run unauthenticated scans because operational restrictions override assessment accuracy.

   Unauthenticated scanning may miss locally visible patch information and does not satisfy the authenticated assessment requirement.
3. Use the approved, read-only assessment account within the authorized substations. ✓

   Authenticated read-only access improves evidence quality while preserving least privilege and the approved assessment scope.
4. Use a shared administrator credential temporarily during the assessment window.

   A shared administrator credential violates accountability and grants broader privileges than the approved assessment requires.

Use an authorized, dedicated read-only account to obtain authenticated evidence without violating least privilege.

2. 162 ÷ 180 = 90% achieved within target: Which answer is correct?

1. 18 ÷ 180 = 10% late remediation

   This calculates the late-remediation rate, not the requested KPI measuring remediation achieved within target.
2. 162 ÷ 187 = 86.6% including critical incidents

   Critical incidents are not part of the defined remediation population and would distort the KPI denominator.
3. 7 ÷ 180 = 3.9% incident exposure among remediation assets

   The incident count represents a separate risk measure and cannot replace the remediation KPI numerator.
4. 162 ÷ 180 = 90% achieved within target ✓

   The KPI denominator is all 180 in-scope assets, and 162 met the stated remediation target.

The remediation KPI is 162 compliant assets divided by 180 in-scope assets, yielding 90 percent.

3. Test representative access-review workflow controls: Which TWO approaches best satisfy the assurance objective

Select two. More than one option is correct — every correct one is ticked below.

1. Test representative access-review workflow controls in a nonproduction environment, alongside production records. ✓

   Nonproduction technical testing avoids production changes while records demonstrate operation throughout the requested period.
2. Ask the control owner to certify that every review operated correctly.

   Owner certification supplies management assertion but lacks independent corroboration for the assurance objective.
3. Have an independent assessor examine sampled review records and interview control owners. ✓

   Independent examination and interviews provide period-specific evidence without changing production systems.
4. Perform unrestricted penetration testing against the laboratory’s production identity systems.

   Unrestricted production exploitation violates the no-change constraint and exceeds evidence needed for access reviews.
5. Review only the laboratory’s current access configuration snapshot.

   A current snapshot cannot establish that reviews operated consistently across the preceding six months.

Independent evidence review and nonproduction technical testing provide assurance without altering production.

4. Define the population as every privileged account active: Which statement best defines the audit population?

1. Use all editing-system users.

   This includes ordinary users excluded by the approved scope and does not limit membership to the audit period.
2. Define the population as every privileged account active from January through March, then report whether testing used a census or a sample. ✓

   This defines membership using the approved account scope and period without assuming that 18 records equal 18 accounts. Census or sampling is a separate testing-method decision.
3. Use the 18 review records.

   Records are evidence, not necessarily the complete population of privileged accounts active during the period.
4. Sample the editing servers.

   Servers are infrastructure units, not the privileged-account population specified by the objective.

The population is every in-scope privileged account active during January through March.

5. Retest the portal with current evidence and configuration: What should the assessor do next?

1. Escalate the finding as confirmed because scanners are objective.

   Scanner output identifies a candidate condition but cannot establish current exposure after configuration changes.
2. Close the finding because the owner disputes the scanner result.

   An owner’s assertion does not validate a potentially stale or still-accurate technical finding.
3. Replace the scanner with an annual policy compliance interview.

   An interview cannot technically verify the portal’s currently offered cipher configuration.
4. Retest the portal with current evidence and configuration verification. ✓

   A current retest and configuration check can confirm whether the reported cipher remains exposed.

Retest with current evidence and verify configuration before deciding whether the finding is false.

6. Stop testing, preserve evidence, and notify the designated: What is the best action?

1. Immediately declare a security incident without following the testing contact procedure.

   The tester should follow the specified notification path; incident classification remains for authorized responders.
2. Erase test artifacts so failed transactions cannot affect the final report.

   Deleting evidence impairs validation, accountability, and accurate reporting of the control failure.
3. Stop testing, preserve evidence, and notify the designated incident contact. ✓

   The observed threshold breach activates the authorized stop condition and required communication process.
4. Continue exploitation until the portal’s full attack surface is mapped.

   Continuing after the defined stop condition violates the authorized rules of engagement and risks additional harm.

The measured breach satisfies the rules-of-engagement stop condition, requiring cessation and notification.

7. Use targeted reinforcement and repeat simulations: What should security recommend?

1. Discontinue simulations because employees completed the required training.

   Completion evidence does not invalidate the simulation’s direct evidence of ineffective security behavior.
2. Use targeted reinforcement and repeat simulations to measure behavior improvement. ✓

   Targeted intervention addresses the highest-failure teams, while simulations test whether behavior improves over time.
3. Repeat the same completion campaign until participation reaches 100 percent.

   Higher attendance would not address the demonstrated gap between course completion and phishing-resistant behavior.
4. Replace the training metric with the number of simulation emails sent.

   Email volume measures activity, not whether employees recognize and resist simulated phishing attempts.

Targeted reinforcement followed by repeat simulations addresses behavior, not merely training completion.

8. An uninvolved independent assessor should perform: Which TWO statements correctly describe the assurance limit

Select two. More than one option is correct — every correct one is ticked below.

1. An uninvolved independent assessor should perform the assurance work. ✓

   Using an assessor without implementation responsibility reduces the identified independence conflict.
2. The team faces a self-review threat that limits its independence. ✓

   Assessing a safeguard the team designed creates a self-review conflict that can impair objective assurance.
3. Operational effectiveness eliminates the team’s independence concern.

   A functioning safeguard does not remove the conflict created by reviewing the team’s own design work.
4. Management approval transfers assurance accountability to the audit team.

   Management approval does not transfer ownership or cure the assessor’s self-review limitation.
5. A favorable report from the same team is fully independent evidence.

   The team’s report remains affected by its prior design role, regardless of the conclusion reached.

Designing and auditing the same safeguard creates self-review risk; independent assessment is the appropriate response.

9. The evidence supports the 25 sampled shipments only: Which answer is most defensible?

1. The complete sample demonstrates that the sensor process was reliable for all refrigerated shipments.

   Complete records for 25 shipments do not establish universal sensor-process reliability across the remaining shipments.
2. The evidence supports the 25 sampled shipments only. ✓

   The evidence directly supports conformity for the tested shipments, while the other 475 remain untested.
3. The approved sample supports concluding that the control operated effectively throughout the quarter.

   The scenario provides no basis for extending the conclusion to every shipment or the entire quarter beyond the sampled evidence.
4. The control should be reported as failed because most shipments were not examined.

   Untested population members create a limitation on assurance, not evidence that those shipments failed the control.

A compliant sample supports the sampled items but cannot establish conformity across all 500 shipments.

10. Prioritize Finding A based on the stronger combination: Which inference is best justified?

1. Treat both findings as equal because each was validated.

   Validation confirms the findings, but priority also depends on exposure, potential business impact, exploitability, and compensating controls.
2. Prioritize Finding B because the platform is obsolete.

   Obsolescence alone does not outweigh Finding A's external exposure, sensitive-data consequence, demonstrated exploitability, and incomplete controls.
3. Defer Finding A because the exploit was demonstrated only in a controlled test environment.

   Controlled testing supports exploitability; it does not negate the portal's production exposure, sensitive-data consequences, or incomplete controls.
4. Prioritize Finding A based on the stronger combination of exposure, consequence, exploitability, and control weakness. ✓

   The available evidence supports higher priority for Finding A without claiming that impact was directly demonstrated in production.

Finding A has the stronger combination of exposure, consequence, exploitability, and incomplete controls.

11. The service owner approves scope: Who should approve the transaction scope while the assessor performs and rep

1. The vendor sets transaction boundaries after observing normal operations.

   A vendor may support execution, but cannot unilaterally establish the operator’s authorized assessment boundaries.
2. The operations team accepts every generated transaction as business activity.

   Synthetic transactions require controlled handling and cannot automatically become genuine operational commitments.
3. The service owner approves scope; the assessor executes and reports results. ✓

   The service owner accepts operational boundaries, while the assessor performs authorized testing and documents evidence.
4. The assessor owns production risk during the test.

   The assessor evaluates controls but should not accept business risk created by the authorized synthetic activity.

The service owner authorizes scope; the assessor executes the defined synthetic test and reports evidence.

12. Require approval: What is the appropriate evaluation?

1. Use backup-job success reports instead of restoration-test evidence.

   Successful backup jobs show that data was copied, not that it can be restored within operational requirements.
2. Require approval, an expiration, compensating measures, and a retest. ✓

   A controlled exception needs accountable authorization, a time limit, risk treatment, and planned verification.
3. Allow the exception until the rebuilt recovery environment becomes available.

   This creates an open-ended exception without accountability, defined duration, or follow-up verification.
4. Accept the exception because rebuilding the recovery environment explains the missed tests.

   An operational explanation does not replace documented authorization, time bounds, compensating treatment, and retesting.

Require authorized, time-bound treatment with compensating measures and retesting.

Other CISSP domains

• Security and Risk Management — 192 questions →
• Security Architecture and Engineering — 156 questions →
• Communication and Network Security — 156 questions →
• Identity and Access Management (IAM) — 156 questions →
• Security Operations — 156 questions →
• All 1200 CISSP questions →
• CISSP certification: requirements, cost and exam format →