For CISSP Domain 6, you must prioritize vulnerabilities based on business impact and asset criticality, not just technical severity. A CVSS 7.5 vulnerability on a public payment server is a higher priority than a CVSS 9.8 on an isolated development server because it poses a greater risk to the business. This judgment-based approach is essential for passing.
A vulnerability scan returns two critical findings. One is a CVSS 9.8 on an internal, air-gapped development server. The other is a CVSS 7.5 on a public-facing web server processing customer payments. Which do you remediate first? If your gut says the 9.8, you've just fallen for the single most common trap on the CISSP exam. The correct answer requires thinking not like a technician, but like a risk advisor to the business.
Key facts
- Domain Name
- Security Assessment and Testing
- Domain Number
- 6
- Exam Weighting
- 12%
- Approximate Questions
- 15 to 21 scored questions (the exam also contains 25 unscored items)
- Official Blueprint
- Aligned with the May 2024 ISC2 CISSP Exam Outline
- Key Standards
- NIST SP 800-53, NIST SP 800-115, ISO/IEC 27001
About These Free Security Assessment and Testing Questions
These CISSP sample questions mirror the real exam's focus on managerial judgment, not just technical recall. They are aligned with the current ISC2 CISSP exam blueprint (effective May 2024) for Domain 6. You can try more adaptive CISSP practice questions with our free trial.
You'll find scenarios that force you to analyze a situation and choose the best course of action from a risk management perspective. As you work through them, don't just look for the right answer. Ask yourself why the other options are wrong for a security leader. This is the mindset we instill at VoraPrep across our complete 6-pillar course. ISC2 data shows pass rates hover around 50-55%, often because candidates mistake the CISSP for a purely technical test.
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Security Assessment and Testing Practice Questions (CISSP Domain 6)
Read each question carefully. Eliminate the answers that are too technical, too narrow, or fail to address the core business risk.
Question 1: Penetration Test Types
An organization has contracted a third-party firm to conduct a penetration test of its external web application. The testers are given no prior information about the network architecture or application source code. Which type of test is being performed?
- A) White-box test: This is the opposite. Testers would have full access to source code, diagrams, and documentation. This is often used for in-depth code reviews.
- B) Gray-box test: This is a hybrid approach where testers are given partial information, such as user-level credentials, but not full architectural details.
- D) Red team exercise: This is a tempting distractor. A red team exercise is a full-scope, objective-based attack simulation against an organization's people, processes, and technology. It's designed to test the effectiveness of the entire security program, including the blue team's detection and response. While it might use black-box techniques, the question specifically describes the testing methodology, making black-box the most precise answer.
Question 2: Responding to Audit Findings
A security audit of a financial services company reveals that several critical security controls mandated by a regulatory standard are not implemented. As the security manager, what is your MOST important next step?
- A) Immediately begin implementing: While this seems proactive, you may not have the authority or budget. Acting without management approval is a classic "technician" mistake on this exam. Management must approve the resources and accept the risk during the remediation period.
- B) Conduct a risk assessment: An audit finding against a mandated regulatory standard implies the risk has already been deemed unacceptable by the regulator. While you will need to assess specifics for your remediation plan, the first step is to communicate the non-compliance upward.
- D) Revoke system access: This is an extreme, business-disrupting action that would be taken without understanding the context or impact. It's a disproportionate response and not the first step a manager would take.
Question 3: Service Organization Controls (SOC)
Which of the following provides the highest level of assurance to a company's leadership regarding a cloud provider's security controls over a period of time?
- SOC 1 vs. SOC 2: SOC 1 reports on controls relevant to a client's financial reporting. SOC 2 reports on controls related to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy).
- Type 1 vs. Type 2: A Type 1 report attests to the design of controls at a specific point in time. A Type 2 report attests to both the design and the operating effectiveness of controls over a period (typically 6-12 months).
Therefore, a SOC 2 Type 2 report provides the most assurance because it covers security-related controls (SOC 2) and verifies that they actually worked over time (Type 2).
Why the others are wrong:- A) SOC 1 Type 1: Wrong focus (financial) and wrong timeframe (point in time).
- B) SOC 2 Type 1: Right focus (security), but only attests to the design at a point in time, not its effectiveness over a period.
- D) Vulnerability assessment report: This is a technical report of specific vulnerabilities, not a formal attestation of the overall control environment by an independent auditor. It serves a different purpose.
Question 4: Application Security Vulnerabilities
During a code review of a new application, a developer points out that while the application properly sanitizes user input to prevent SQL injection, it writes detailed error messages containing stack traces and database schema information to the user's browser. What type of vulnerability is this?
- B) Cross-Site Scripting (XSS): This involves injecting malicious scripts into a web page that then execute in another user's browser. That is not what is described.
- C) Insecure Direct Object Reference (IDOR): This occurs when an application exposes a direct reference to an internal object and fails to perform an access control check. The scenario describes information leakage, not an access control failure.
- D) Security Misconfiguration: This is a broad category. While Improper Error Handling could be seen as a type of misconfiguration, it is a more specific and accurate description of the vulnerability presented. Always choose the most precise answer on the CISSP.
Question 5: Automated Testing Techniques
A company wants to assess the security of a new network device before deploying it. They decide to use a testing method that involves sending malformed packets and unexpected input to the device's network interfaces to see if it causes a crash or other unstable behavior. What is this testing technique called?
- A) Static analysis: This involves analyzing code or binaries without executing them. The scenario describes an active test against a running device.
- C) Penetration testing: This is a broader term for a goal-oriented attack simulation. While a penetration tester might use fuzzing as a technique, the technique itself is called fuzzing.
- D) Log review: This is a detective process of analyzing logs to find evidence of an incident. It is a post-event analysis, not a proactive test.
Question 6: Vulnerability Remediation Prioritization
You are prioritizing findings from a quarterly vulnerability scan of your organization's servers. The report shows hundreds of vulnerabilities. Which factor is MOST critical in determining the order of remediation?
- Single Loss Expectancy (SLE) = Asset Value × Exposure Factor = $5,000,000 × 0.60 = $3,000,000
Now consider the isolated lab server, valued at $10,000. Even if a breach caused a total loss (EF = 100%), the SLE is only $10,000.
- SLE = $10,000 × 1.0 = $10,000
As a risk advisor, you prioritize the potential $3,000,000 loss over the $10,000 loss, regardless of the CVSS score. This is the judgment the exam demands.
- A) The CVSS base score: Tempting, but incomplete. It ignores the context of the asset.
- B) The availability of a patch: This influences the ease and method of remediation, but not the priority. You might need to implement compensating controls for a high-priority vulnerability with no patch.
- D) The number of assets affected: This helps determine the scale of the effort but not the initial priority. One critical asset is more important than 100 non-critical ones.
Question 7: Proactive Performance Monitoring
Which of the following is a primary benefit of synthetic transaction monitoring?
- A) It analyzes real user traffic: This describes Real User Monitoring (RUM), which is a different, reactive technique.
- C) It performs deep code analysis: This describes Static Application Security Testing (SAST).
- D) It collects and aggregates system logs: This describes a Security Information and Event Management (SIEM) system.
Question 8: Disaster Recovery Testing
The main purpose of a disaster recovery test is to:
- A) Ensure all employees are trained: Training is a part of testing, but the test's main purpose is to validate the plan, not just the people.
- C) Test the effectiveness of backup media: This is a crucial component of a DR test, but it's not the overall purpose. A full test also validates network failover, communication plans, and personnel.
- D) Satisfy regulatory audit requirements: This is often a driver for testing, but it's a business goal, not the technical purpose of the test itself. You test to validate the plan; a successful validation then satisfies the auditors.
Question 9: Test Data Management
A development team is building a new customer relationship management (CRM) module. To ensure realistic testing, they have requested a direct copy of the production customer database for use in their development environment. What is the MOST appropriate response from a security perspective?
- A) Approve the request: This ignores the security risk and violates the principle of least privilege and data minimization.
- B) Deny the request...: While secure, this may not provide a realistic enough dataset for effective testing, potentially leading to bugs in production. The goal is to enable the business securely, not just say no.
- C) Approve the request...: Replicating production controls in a development environment is often cost-prohibitive and impractical. It also doesn't address the core issue of developers having unnecessary access to sensitive production data. The better solution is to remove the sensitivity from the data itself.
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score? A 7-Day Sprint to Master Domain 6
Don't just count the right and wrong answers. A score on a short quiz isn't a verdict; it's data. It shows us where to focus. If you struggled, you're not alone. This domain trips up candidates who think like technicians instead of managers.
Let's turn that data into a concrete, one-week improvement plan.
Day 1: Triage Your Results
Categorize your mistakes. Go back through the questions you missed. Were they due to:- Fact Recall? (e.g., not knowing the difference between SOC 2 Type 1 and Type 2)
- Mindset Error? (e.g., choosing the technical solution instead of the managerial one)
- Concept Misunderstanding? (e.g., confusing synthetic monitoring with RUM)
Be honest. This tells you whether you need to drill flashcards (recall) or recalibrate your thinking (mindset).
Day 2: Master the Managerial Mindset
If you made mindset errors, this day is for you. Your job on the CISSP exam is to be a risk advisor. For every future practice question, ask yourself:- Does this answer manage or reduce risk for the business?
- Does this answer involve reporting, planning, or policy? (Good)
- Does this answer involve me personally configuring a device? (Bad)
This is the core skill. The VoraPrep adaptive learning engine is designed to find these weak spots and give you more questions that test this specific judgment.
Day 3: Deep Dive on Testing Types
Create a simple table in your notes. This is a high-yield area for the exam.| Test Type | Goal | Knowledge Given | Example |
|---|---|---|---|
| Vulnerability Scan | Find known vulnerabilities | Authenticated or unauthenticated | Running Nessus against a subnet |
| Penetration Test | Find exploitable pathways and business risk | Varies (Black, White, Gray) | Hired to "steal customer data" |
| Code Review (SAST) | Find flaws in source code | Full source code access | Using SonarQube on a codebase |
| Dynamic Analysis (DAST) | Find flaws in running application | None (black-box) | Using a web app scanner |
| SCA | Validate control effectiveness against a baseline | Full cooperation expected | NIST 800-53A assessment |
| Audit | Measure compliance against a standard | Full cooperation expected | A PCI DSS or ISO 27001 audit |
Day 4: Focus on Reporting and Communication
Domain 6 isn't just about finding flaws; it's about communicating them effectively. Review the concepts of audit reports, vulnerability scan reports, and after-action reports from DR tests. The key is tailoring the message to the audience. Executives need to see risk in terms of dollars (SLE/ALE) and strategic impact. Technical teams need actionable details.Day 5: Spaced Repetition Flashcards
For the factual knowledge you identified on Day 1, create flashcards.- Front: "Which SOC report proves controls worked over time?" -> Back: "SOC 2 Type 2"
- Front: "What testing method uses random, malformed input?" -> Back: "Fuzzing"
VoraPrep includes thousands of pre-built, memory-scheduled flashcards that use a sophisticated algorithm (FSRS) to show you the right card at the exact moment you're about to forget it.