Domain 6 CISSP Exam: Security Assessment and Testing

Explanation: Logs play an essential role as detective controls in a security program. Assessments and audits often rely on log entries as artifacts to directly prove that the organizations technical controls are in place and operating as intended.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 563 in PDF)

Explanation: Implementing request throttling is a proper configuration solution to reduce the volume of traffic generated by vulnerability scanners and limit the number of requests the scanner generates in a given time period. This can help prevent DoS conditions on both networks and systems. Other solutions like increasing the number of requests, disabling throttling, or conducting scans at times of high user activity can increase the risk of DoS conditions and are not recommended.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 551 in PDF)

Explanation: EDR and SIEM are technical processes that detect incidents or deviations. EDR is endpoint detection and response, which detects and responds to advanced security threats on endpoints, and SIEM is security information and event management, which collects and analyzes log data to detect security incidents.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 575 in PDF)

Explanation: A major consideration for organizations with mixed IT environments when choosing and configuring a vulnerability scanner is the platform support. This is because organizations with mixed IT environments may have different operating systems, such as Linux and Windows, which require different scanners. Thus, using a vulnerability scanner that supports multiple platforms ensures that a comprehensive assessment is conducted. Other factors such as legal, contractual, or regulatory obligations, or the depth, scope, or coverage of the scanner are also important considerations. However, platform support is a major consideration, especially for mixed IT environments.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 549 in PDF)

Explanation: Mandatory reporting refers to the legal and regulatory frameworks that mandate security researchers to report a discovered vulnerability to law enforcement or other authorities. Therefore, it is the correct answer.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 594 in PDF)

Explanation: One way to evaluate the effectiveness of a security training and awareness program is by measuring whether employees are actually able to apply the knowledge they acquired during training to real-life situations. For instance, identifying a phishing email or recognizing unexpected system behavior could be indications of employees active involvement in implementing the training.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 584 in PDF)

Explanation: Breach and attack simulations (BAS) combine elements of vulnerability scanning and automated penetration testing, utilizing a continuously refreshed database of attack methods and newly discovered vulnerabilities to test the ability for the organization to withstand newly evolved threats.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 570 in PDF)

Explanation: In this scenario, the proposed policy has administrative components like an acceptable use policy and employee training and awareness, and it may comprise technical controls like web content filters or blocklists. Measuring the number of users who have read and acknowledged their understanding of the policy by signing it is an effective way to determine policy reach and ensure employee awareness about the policy.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 576 in PDF)

Explanation: ISO 27001 control 9.3 requires management to periodically review the information security program for continuing suitability, adequacy and effectiveness.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 579 in PDF)

Explanation: Preventative technical processes include encryption of data and securing access to decryption keys, network access controls like virtual private networks (VPNs), and endpoint controls like host-based firewalls. Designing a technical metrics program should be done to measure the organizations effectiveness at implementing multilayered security. To do so, it is useful to capture metrics across categories like Prevent, Detect, and Respond. Therefore, the correct answer is C because preventative technical processes are measured in the Prevent category of technical metrics.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 575 in PDF)

Explanation: MTTR is a key performance indicator that measures the time required to recover from a security incident. It is an important metric in assessing the effectiveness of a security program in responding to and resolving incidents. A shorter MTTR indicates a more effective security program in terms of incident response and resolution.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 582 in PDF)

Explanation: Defined rules of behavior provide guidelines and set ground rules for testers to follow, ensuring everyone involved in the testing process is safe and that testers do not accidentally cause a Business Interruption event or provoke external incidents. This also helps ensure that the pen testing engagement is properly managed, that proper documentation for the testing results, incident records, and reporting are available.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 556 in PDF)

Explanation: Pen testers use tools like Nmap, nslookup, ping sweeps, and port scanning to perform queries that determine active network hosts and services running on a network, which is a part of network footprinting.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 560 in PDF)

Explanation: Compliance auditors are a common method of checking the status of controls in place to meet compliance objectives. Compliance audits or assessments are conducted on a defined schedule to evaluate the security program at a specific point in time. Compliance checks are part of oversight designed to verify the status of controls in place to meet compliance objectives.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 572 in PDF)

Explanation: Responsible disclosure is the principle that the discoverer of a vulnerability has a responsibility to report the weakness to the organization in a timely manner and give the organization time to fix the vulnerability before publicly disclosing it.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 593 in PDF)

Explanation: ISO/IEC 18045:2008 is a companion to ISO 15048 and provides standards for consistent criteria and evaluation methods.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 596 in PDF)

Explanation: To design a security metrics program, two key elements are essential. First, an understanding of the security program objectives is necessary as it provides the reference point for the metrics. Second, the security controls must provide a method of measurement or quantification. For example, if multifactor authentication is required for all logins, access control logs can be queried to determine if this requirement is enforced 100 percent of the time. Therefore, option D is correct.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 574 in PDF)

Explanation: A sound third party audit strategy must be scoped to include any third-party critical to the organizations operations, handling any data valuable to the organization, or providing regulated services like payment processing. Therefore, option D is the correct answer.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 547 in PDF)

Explanation: Performing a test restore from backup media is important to verify that all required data is present and readable. This ensures that the backup data is usable in the event of data loss or corruption. If data is missing, it could indicate backup configuration issues or corruption of the backup media.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 584 in PDF)

Explanation: The goal of fingerprinting network endpoints is to discover useful details like operating system and application software versions, which is useful for choosing and executing specific exploits.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 562 in PDF)

Explanation: The key advantage of an external auditor is total independence from the organization being audited, but one of the potential drawbacks of using external auditors is the cost, which can be significant for large and complex audits, as well as their lack of knowledge about an organizations operations. This can lead to false positive audit findings.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 597 in PDF)

Explanation: Vulnerability scanners may generate excessive traffic and lead to a DoS. This can affect network performance while detecting vulnerabilities. Excessive scanning can also generate false positives and alert the wrong people, leading to unnecessary panic or ignoring real incidents.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 551 in PDF)

Explanation: Synthetic transactions can be used to log into an application every hour to verify if the service meets the agreed level of service, which is the purpose of SLA monitoring.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 565 in PDF)

Explanation: According to DOMAIN 6 of CISSP, preventative technical processes in security assessment and testing include encryption of data and securing access to decryption keys, network access controls like virtual private networks (VPNs), and endpoint controls like host-based firewalls.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 575 in PDF)

Explanation: A KPI, or key performance indicator, uses metrics and provides context to provide an indication of performance of a process or system. It is designed to identify how effectively controls are operating to mitigate risks, and provide notice if a control is ineffective, which indicates a risk that may be more likely to occur.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 582 in PDF)

Explanation: According to the text, ISO/IEC 27006:2015 is the official set of requirements and guidance for auditors performing certification audits against ISO 27001.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 596 in PDF)

Explanation: The goal of the exploitation phase in pen testing is to gain access to systems or data that should not be accessible. Testers use a variety of methods, such as automated or manual exploitation tools, to try to exploit the identified vulnerabilities.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 561 in PDF)

Explanation: SOC 2 requires management to establish “performance measures,” as well as generate and use “relevant, quality information to support the functioning of internal control.” This framework focuses primarily on security and availability controls for systems that store, process, and/or transmit data. The other frameworks have similar requirements for management review and oversight, but do not specifically mention generating performance measures to support internal control.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 580 in PDF)

Explanation: The primary importance of generating reports for security evaluations such as vulnerability scans, penetration tests, gap assessments, continuous monitoring, and audits is to summarize key details of testing and evaluation activities, including findings or issues discovered, actions performed during testing, and any recommended remedial steps to address the findings. It is essential to generate reports to communicate the results of the security testing to the appropriate audience or user of the report. The report must identify the audience or user of the report, which is crucial to determine appropriate levels and types of details to include.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 587 in PDF)

Explanation: Interface testing is essential in evaluating the functionality and security of the systems various interfaces, including the user interface and APIs. This type of testing identifies if the interface behaves as expected under different scenarios and verifies if the interface has adequate data protection controls implemented to support the organizations security goals. It is also a crucial element in security testing activities like vulnerability assessments, penetration tests, and security testing like breach simulations.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 569 in PDF)

Explanation: KPIs are used to monitor the state of existing security controls and their effectiveness at mitigating risk, while KRIs monitor potential future risks. Both are essential to a GRC program and provide proactive and reactive input to the GRC strategy.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 580 in PDF)

Explanation: The primary purpose of misuse case testing is to identify vulnerabilities that might be exploitable under unexpected circumstances. It assesses how a system or application responds to unexpected inputs or situations and identifies vulnerabilities. For instance, a misuse case for system login would describe the steps taken when a user enters incomplete login information. Several vulnerabilities have been found in several applications when users supply incomplete or unexpected information at a login prompt.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 567 in PDF)

Explanation: Branch coverage measures whether each branch in a control statement has been executed. Control statements are program structures like loops and conditional statements that affect the flow of the program. This type of coverage ensures that all execution paths of a program or system have been tested.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 568 in PDF)

Explanation: A recurring audit schedule allows the organization to track its security program over time and identify areas that need improvement. This approach also helps the organization show the effectiveness of its security program and how it has improved over time.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 595 in PDF)

Explanation: ISO 27001 control 9.3 specifies that management must periodically review the information security program for “continuing suitability, adequacy and effectiveness.”

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 579 in PDF)

Explanation: It is important to ensure that access to resources is removed within specified timeframes after a user changes roles or leaves employment so as to prevent unauthorized access. This is a key process data to collect from account management processes.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 577 in PDF)

Explanation: NIST Special Publication (SP) 800-53A is a guide to assessing the controls outlined in NIST SP 800-53. It introduces a simple set of testing procedures to assess control effectiveness: test, examine, or interview. Although applicable to U.S. government agencies, it is freely available and may be adapted for use by any organization.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 595 in PDF)

Explanation: The oversight task of management review and approval processes related to security is a key element of governance and risk management, which is covered in Chapter 1.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 579 in PDF)

Explanation: ISO/IEC 15408-1:2009 is the foundation for the Common Criteria certification, which is a formal assessment process for technology products against a defined set of security functional requirements. It provides evaluation criteria for IT security, and is available free of charge.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 595 in PDF)

Explanation: ISO 27001 control 9.3 specifies that management must periodically review the information security program for continuing suitability, adequacy and effectiveness.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 580 in PDF)

Explanation: Distributed scanning is an architecture that places scanning agents inside network segments to allow the endpoints in that segment to be scanned and then consolidates the results to a central console. This is a way to overcome the difficulties introduced by network segmentation with access controls when performing vulnerability scanning.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 553 in PDF)

Explanation: The text states that most compliance frameworks recognize that an audit at a single point in time is not an effective way to monitor security risk. However, scheduled audits or assessments conducted on a defined schedule, such as annual audits for PCI-DSS and SOC 2, or ISO 27001 audits once every three years, are effective ways to evaluate the security program at a specific point in time. Additionally, compliance frameworks typically include requirements for more frequent assessment of key controls or areas.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 571 in PDF)

Explanation: An increase in the number of phishing attempts detected or reported is often the precursor to an attack, as attackers seek to gain valid credentials to access the organizations resources. As a response, additional system monitoring, MFA, and user training could all be deployed to prevent successful attacks.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 584 in PDF)

Explanation: The purpose of sampling in the audit technique is to reduce the amount of work required while maintaining assurance that deficiencies are identified. Sampling is a technique utilized in audits to balance the cost of work to gather information and gain assurance against the benefit of risk visibility. The sample should be representative to ensure that identified deficiencies are applicable to the entire population of systems.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 596 in PDF)

Explanation: The administrative process for requesting user access, including formal request and approval before access is granted, may require an access request ticket or hard-copy access request form, and all user accounts must have corresponding request and approval documents, which must contain all required information like user role, justification for access, and necessary approvals. This control may also involve audit and other assurance activities. Therefore, option A is correct.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 576 in PDF)

Explanation: The terms KPIs and metrics are often used interchangeably, but there is a difference. Metrics are simply measurements, like the number of patches applied to a computing environment. A performance indicator uses metrics and provides context (an indication).

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 581 in PDF)

Explanation: Synthetic transactions can be used to monitor complex business logic rules that process data. By simulating the inputs to these rules, administrators can check if the output items the expected result. This helps to ensure that data integrates are being maintained as expected.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 564 in PDF)

Explanation: Breached attack simulation (BAS) tools can test email security controls with generated test messages. If messages can reach inboxes or are opened, its an indication of a deficiency in email security controls.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 571 in PDF)

Explanation: ISO/IEC 15408-1:2009 is the foundation for the Common Criteria certification, which is a formal assessment process for technology products against a defined set of security functional requirements.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 596 in PDF)

Explanation: Black-box testing models the perspective of an external attacker, while white-box testing has knowledge of internal elements of the application that an outsider would not have. Black-box testers do not have access to the source code or internal workings of the application, while white-box testers do.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 565 in PDF)

Explanation: Breach attack simulations (BAS) are performed to simulate a real attacker attempting to gain unauthorized access on an organizations network or system. BAS utilizes a continuously refreshed database of attack methods and newly discovered vulnerabilities to test the organizations ability to withstand newly evolved threats. The purpose of BAS is to identify potential vulnerabilities sooner than traditional approaches like a quarterly vulnerability scan or yearly penetration test to ensure that the organizations security controls function as intended.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 571 in PDF)

Explanation: Management support and sponsorship of security initiatives is crucial because it provides direction and support. Management review and approval of security process data should be performed to ensure that controls are functioning as intended; that is to say that they are reducing risks to an acceptable level and that previously accepted risks are still within acceptable parameters. Changes to the organizations operating environment can render controls ineffective, even if they were previously adequate to reduce risks. Examples include launching new lines of business, the addition of new systems or processes, new compliance or regulatory obligations, and organizational changes like mergers, acquisitions, and divestitures. Therefore, management needs to make informed decisions about identifying risks and mitigating actions.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 578 in PDF)

Explanation: Full disclosure means reporting a vulnerability transparently to the organization responsible for fixing it as soon as possible. It is a philosophical argument that all discovered weaknesses should be reported fully and transparently to the responsible organization. While the goal of improving security is admirable, some vendors may not be open to researchers who attempt to report vulnerabilities.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 593 in PDF)

Explanation: The Mean time to detect (MTTD) metric measures the mean time required to detect a security incident or threat. It is an essential KPI for organizations since it helps them to understand how effectively their controls are operating to mitigate risk and provide notice if control is ineffective indicating a risk that may be more likely to occur.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 582 in PDF)

Explanation: Black-box testing provides zero knowledge to the attacker and instead relies on them to perform reconnaissance to gather details. The name demonstrates how the interior of the system (the “box”) is completely in shadow or dark to the tester.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 555 in PDF)

Explanation: The final phase of a pen testing activity is documenting a report on the vulnerabilities found and exploited. This report is used to help the organization improve their cyber defenses.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 558 in PDF)

Explanation: FedRAMP requires an ongoing annual assessment after the initial full security assessment and also requires a continuous monitoring strategy for key risks in order to maintain Authority to Operate (ATO) status.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 572 in PDF)

Explanation: White- or crystal-box testing provides complete knowledge of the system or network to be tested, like IP addresses and system version numbers. This allows for more complete test coverage and simulates an insider threat.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 554 in PDF)

Explanation: Synthetic transactions can be employed as a test mechanism for a variety of purposes, including SLA monitoring. Hosted or cloud-based services may guarantee certain levels of service, and synthetic transactions can be used to log into the application every hour to verify if the service meets the agreed level.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 564 in PDF)

Explanation: When conducting a third-party audit, a security practitioner should seek to answer questions related to the third-partys security program. This includes the standards they use for selecting controls and auditing their effectiveness. By doing so, the practitioner can assess whether the third-party has adequate controls in place to mitigate risks that could impact the organization.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 598 in PDF)

Explanation: Responsible disclosure is defined as a principle wherein a vulnerability or weakness is fully and transparently reported to the organization responsible for fixing it as soon as possible.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 594 in PDF)

Explanation: Identifying the organizations critical assets is important to choose appropriate scanning tools and prioritize scanning efforts. Vulnerabilities in highly critical systems should be prioritized first since exploiting a vulnerability in a low criticality system is less likely to disrupt operations. The asset inventory may also capture important data, like the system classification, needed to scope vulnerability assessments.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 549 in PDF)

Explanation: An increase in the number of security incidents could indicate that the threat environment has changed, and more robust security tools or additional staff are needed.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 584 in PDF)

Explanation: ISO 27001 requires an external audit every three years while the organization must perform continuous monitoring and oversight, including internal auditing and surveillance audits on an annual basis. It also requires the evaluation of security over a period of performance. It is the only option listed that requires both an external audit and internal activities such as quarterly vulnerability scans.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 572 in PDF)

Explanation: Administrative processes for requesting user access require policies and procedures to be implemented using technology systems and may require physical controls like managing facility access or safeguarding account tokens like smart cards, making it a crucial example of blended control types in account management.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 577 in PDF)

Explanation: Using a standard methodology for audit and assessment offers key benefits including repeatable testing and results that will be more comparable over time. This ensures consistency in testing practices and allows for the measurement of return on investment from the organizations spending on security efforts over time.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 543 in PDF)

Explanation: ISO 27001 control 9.3 specifies that management must periodically review the information security program for continuing suitability, adequacy and effectiveness.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 580 in PDF)

Explanation: All of the given elements are important considerations for a security assessment and testing related to disaster recovery and business continuity (BCDR) plan. The reliance on critical third-party services, training of new staff, storage and accessibility of the BCDR plan, testing the plan regularly, and maintaining a check on any significant changes in the organization are essential elements for an effective disaster recovery and business continuity plan.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 585 in PDF)

Explanation: Marking port scans from a vulnerability scanners IP address as nonsuspicious is essential to prevent security alerts and incident response processes from being triggered by legitimate vulnerability scanning. Vulnerability scanners perform many of the same actions as attackers, and identifying their activity as suspicious could result in unnecessary and costly incident response actions. By marking the scanners IP address as nonsuspicious, the security team can focus on responding to actual threats and vulnerabilities.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 552 in PDF)

Explanation: The purpose of Key Risk Indicators (KRIs) is to provide a window into future risks and drive proactive mitigating action, such as upgrading a firewall before it is overwhelmed. KRIs provide an organization with a chance to prepare for future risks and a chance to take mitigating action before the risk becomes a problem. Therefore, option B is the correct answer.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 583 in PDF)

Explanation: Preventative technical controls include encryption of data and securing access to decryption keys, network access controls like virtual private networks (VPNs), and endpoint controls like host-based firewalls.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 575 in PDF)

Explanation: Full disclosure argues that any time a weakness is discovered, it should be fully and transparently reported to the organization responsible for fixing it as soon as possible, which means immediate public disclosure of the vulnerability. Responsible disclosure, on the other hand, defines a responsibility for the discoverer to report a weakness to the organization in a timely manner and give them time to fix the vulnerability before publicly disclosing it.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 594 in PDF)

Explanation: Segregated VLAN or restrictive firewall rules are examples of physical controls that can be used to enforce access control in an information system. Physical controls are used to safeguard physical access to system components or to manage physical access tokens like smart cards, and are crucial to ensure restricted physical access is maintained. Options A, C, and D are examples of administrative or technical controls.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 578 in PDF)

Explanation: The purpose of the reporting phase in pen testing is to capture all activities performed, vulnerabilities found, and access achieved, and to provide recommendations to remediate any identified vulnerabilities. The report is usually presented in a formal meeting, which marks the end of the pen test engagement. The different parts of the report may be designed for different audiences, such as an executive summary for management and a more technically detailed report for IT staff.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 562 in PDF)

Explanation: An assessment involves evaluating the likelihood of a specific risk and measuring or estimating the impact of risks that could affect those assets, while an audit is a more formal process that involves a systematic analysis against a defined standard to determine if the object meets a set of criteria. Therefore, option B is the correct answer.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 542 in PDF)

Explanation: White- or crystal-box testing is total transparency. The pen testers have complete knowledge of the system or network to be tested, like IP addresses and system version numbers. Black-box testing provides zero knowledge to the attacker and instead relies on them to perform reconnaissance to gather details. The name demonstrates how the interior of the system (the “box”) is completely in shadow or dark to the tester.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 554 in PDF)

Explanation: The primary purpose of performing discovery or reconnaissance during the pen testing phase is to emulate the behavior of attackers by gathering information about the target. This information can be used to create a more effective attack simulation.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 559 in PDF)

Explanation: Assessments conducted from an internal perspective are appropriate as part of ongoing or continual assessment processes and are often used as part of continuous monitoring with a supplemental external audit performed less frequently.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 542 in PDF)

Explanation: Physical pen testers should be provided with a get out of jail free card that details the purpose of their activity and a point of contact within the organization who can verify their story in the event they are caught or detained. This card can be presented to help them avoid potential legal trouble like being arrested and charged with trespassing.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 563 in PDF)

Explanation: Internal auditors may lack sufficient independence to perform an objective assessment. Finding a major issue that could impact financial performance or the auditors relationship with team members can create an incentive to downplay issues discovered. In some organizations, this can be solved by making auditors a separate team within the company, though for smaller organizations, that may not be a viable option.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 597 in PDF)

Explanation: A KPI is a performance indicator that uses metrics and provides context. It exists to identify how effectively controls are operating to mitigate risks, and provide notice if a control is ineffective, which indicates a risk that may be more likely to occur. When designing KPIs for the organizations security program, it is helpful to understand the information needed by the organization and essential to ensure the KPIs provide clear information to support decision making.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 583 in PDF)

Explanation: The main goal of conducting or facilitating a security audit is to compare some aspect of an organization against a standard. This allows the auditor to identify areas where the organization is not meeting the standard and to make recommendations for improvement.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 595 in PDF)

Explanation: NIST Special Publication (SP) 800-53A is a guide to assessing the controls outlined in NIST SP 800-53. It introduces a simple set of testing procedures to assess control effectiveness: test, examine, or interview. Although applicable to U.S. government agencies, it is freely available and may be adapted for use by any organization.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 596 in PDF)

Explanation: Fostering a relationship across teams is important to ensure that vulnerabilities are taken seriously and addressed. Communicating context to the audience is important and may require formatting results in a way that is best suited to the asset owner, especially nonsecurity personnel who typically do not understand CVSS scores. This will help the asset owner to take action on the findings. Hence, option C is the correct answer.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 552 in PDF)

Explanation: The main goal of implementing a process for remediation is to address any security vulnerabilities discovered during security testing, evaluations, assessments, and audits. This includes prioritizing work to be performed, identifying timelines and milestones, and tracking the work through to completion.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 589 in PDF)

Explanation: An increase in the number of security incidents can indicate that the threat environment has changed, and more robust security tools or additional staff are needed to handle the increased risk. This KRI can help drive proactive measures to prevent security incidents before they occur.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 584 in PDF)

Explanation: When a situation arises where a risk cannot be treated, an exception must be granted. The key components of documenting an exception in the exception handling process include risk details, reason for the exception, compensating controls, an explicit decision of exception approval, and time. These components help to identify and explain the issue, provide reasoning for the exception, partially mitigate the risk with compensating controls, and to limit the time-frame for the exception.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 590 in PDF)

Explanation: Behavior-based breach attack simulations specifically test security controls such as security tools monitoring for malicious network scans or complex interactions with applications that should be blocked by a web application firewall (WAF).

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 571 in PDF)

Explanation: When performing a vulnerability assessment, it is crucial to understand the criticality of each system to prioritize scanning efforts and choose appropriate scanning tools. Vulnerabilities in highly critical systems should be prioritized first since exploiting a vulnerability in a low criticality system is less likely to disrupt operations. Therefore, the criticality of the systems is a significant factor to consider.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 549 in PDF)

Explanation: Vulnerability scanners can perform automated actions like filling in form fields on a web application to check for issues including Structured Query Language (SQL) injection or cross-site scripting (XSS). However, this testing data is obviously not real data that belongs in the system and can cause issues with reports or processes that expect valid data stored in the system.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 553 in PDF)

Explanation: The executive summary section of an audit report provides a high-level overview of testing activities and findings, typically taking up no more than one page. It gives the reader a quick understanding of the overall testing process and the main findings.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 588 in PDF)

Explanation: According to the text, external testing may be advisable or even required in some cases, especially for legal or regulatory reasons, such as maturity assessments against a maturity model or compliance purposes like PCI-DSS, ISO 27001, and the U.S. governments Federal Risk and Authorization Management Program (FedRAMP), which all require the use of an independent, authorized third-party auditor or assessor. Compliance with these standards brings a certain level of assurance to the clients or other companies doing business with audited firms, which makes it important that the audits be performed by a third-party with no active conflict of interest (Source: CISSP Study Guide by Sybex).

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 546 in PDF)

Explanation: Synthetic transactions can be employed as a test mechanism to monitor SLA agreements to ensure the service is meeting the agreed level of service.

Ref: The Official ISC2 CISSP CBK Reference 6th Edition

(Page 564 in PDF)