Certified Information Systems Security Professional (CISSP) Security Assessment and Testing Syllabus

Security Assessment and Testing syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Assessment and Testing in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Assessment and Test Strategies

   3 topics

   • Designing Assessment Programs
     • Internal, external, and third-party assessments
     • Defining scope, rules of engagement, and objectives
     • Assessment standards and frameworks
   • Control Validation Approaches
     • Verification versus validation
     • Compliance checks and gap analysis
   • Account and Access Review
     • Reviewing user and privileged accounts
     • Service account hygiene
2. 2

   Security Testing Techniques

   4 topics

   • Vulnerability Assessment
     • Automated scanning and authenticated scans
     • Network, host, and application scanning
     • False positive triage and CVSS scoring
   • Penetration Testing
     • Black-box, white-box, and gray-box testing
     • Reconnaissance, exploitation, and reporting phases
     • Red, blue, and purple team exercises
   • Software Testing Methods
     • Static application security testing (SAST)
     • Dynamic application security testing (DAST)
     • Fuzzing, misuse case testing, and code review
     • Interface and regression testing
   • Log Review and Synthetic Monitoring
     • Real user monitoring vs synthetic transactions
     • Log analysis for security events
3. 3

   Audit and Reporting

   3 topics

   • Audit Strategies and Standards
     • Internal audits and management
     • External and third-party audits
     • SOC 1, SOC 2, and SOC 3 reports
   • Collecting Security Process Data
     • Key performance and risk indicators
     • Technical and management control metrics
     • Training and awareness effectiveness data
   • Reporting and Remediation
     • Writing actionable test reports
     • Risk-prioritized remediation tracking
     • Exception handling and ethical disclosure

Security Assessment and Testing flashcards for Certified Information Systems Security Professional (CISSP)

21 of 50 cards from the Security Assessment and Testing deck — real questions with worked answers.

1. What is a security assessment in the context of CISSP Domain 6?

   A comprehensive review of the security of a system, application, or environment that combines many tools and techniques (vulnerability scans, pen tests, log reviews, interviews) to gauge overall security posture, usually producing recommendations rather than a pass/fail result.

2. How does a security audit differ from a security assessment?

   An audit is a formal, structured evaluation performed by an independent party against a specific standard or set of controls, producing attestation/evidence of compliance. An assessment is broader, often internal, and aimed at identifying and improving weaknesses rather than formally attesting to compliance.

3. What is a security test?

   A verification that a specific security control is functioning properly, such as a vulnerability scan, penetration test, or configuration review. Tests are the granular activities that feed into broader assessments and audits.

4. What three categories of audits are distinguished by who performs them?

   Internal audits (performed by the organization's own staff), external audits (performed by an outside firm), and third-party audits (performed by an independent auditor, often for regulatory or partner assurance).

5. What is the purpose of the SOC (Service Organization Control) reporting framework?

   SOC reports, governed by SSAE 18, provide assurance about controls at a service organization so its customers can trust outsourced services. They are produced by independent auditors (typically CPAs).

6. Compare SOC 1, SOC 2, and SOC 3 reports.

   SOC 1 covers controls relevant to financial reporting (ICFR). SOC 2 covers the five Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) and is restricted-use. SOC 3 is a public, general-use summary version of a SOC 2.

7. What is the difference between a SOC Type I and a SOC Type II report?

   Type I assesses whether controls are suitably designed at a single point in time. Type II assesses both design AND operating effectiveness of controls over a period of time (typically 6-12 months), making it stronger assurance.

8. What are the five Trust Services Criteria covered by a SOC 2 report?

   Security (the only mandatory one, called the Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.

9. What is the purpose of designing a security assessment program?

   To ensure ongoing, systematic evaluation of controls by defining what will be tested, how often, by whom, with what tools, and how results are reported—aligning testing with risk, compliance requirements, and business objectives rather than ad hoc checks.

10. What three sources of requirements typically drive the scope and frequency of a security assessment program?

    Risk to the organization (higher-risk systems tested more often), regulatory/compliance mandates (e.g., PCI DSS), and the value/sensitivity of the assets and data involved.

11. What is the difference between control validation by examination, interview, and testing?

    Examination reviews documents/configurations/evidence; interview gathers information by questioning personnel; testing actively exercises the control (e.g., trying an exploit) to verify it works. These three methods are defined in NIST SP 800-53A.

12. Distinguish a manual control test from an automated control test.

    A manual test requires a human to perform and evaluate it (e.g., reviewing a sample of access requests). An automated test uses tools/scripts to continuously or repeatedly verify the control (e.g., a scheduled vulnerability scan or configuration scanner).

13. What is an account/access review and why is it performed?

    A periodic review of user accounts and their assigned privileges to verify they are still appropriate—detecting orphaned accounts, excessive privileges, dormant accounts, and violations of least privilege or separation of duties.

14. What is privilege creep (aggregation) and how do access reviews address it?

    Privilege creep is the gradual accumulation of access rights as users change roles without old permissions being revoked. Access reviews detect and remove these excess privileges to restore least privilege.

15. What is an orphaned account and why is it a security risk?

    An orphaned account is one that remains active after its owner has left the organization or no longer needs it. It is a risk because it can be exploited without anyone noticing the legitimate user is gone, and it lacks accountability.

16. In access reviews, what is the difference between entitlement review and recertification?

    An entitlement review examines the specific permissions/rights granted to accounts. Recertification (attestation) is the process where a manager or data owner formally confirms that each user's access is still required and appropriate.

17. What is a vulnerability assessment?

    The systematic identification, classification, and prioritization of security weaknesses (vulnerabilities) in systems, typically using automated scanners, without actively exploiting them.

18. What is the difference between an authenticated (credentialed) and unauthenticated (uncredentialed) vulnerability scan?

    An authenticated scan logs into the target with valid credentials to inspect configuration and patch level from the inside, giving deeper and more accurate results. An unauthenticated scan probes only from the outside, like an external attacker, finding fewer issues with more false positives.

19. What is a false positive versus a false negative in vulnerability scanning?

    A false positive is a reported vulnerability that does not actually exist. A false negative is a real vulnerability the scanner failed to detect—false negatives are more dangerous because the weakness goes unaddressed.

20. What is CVSS and what range do its base scores use?

    The Common Vulnerability Scoring System is a standardized framework for rating the severity of vulnerabilities. Base scores range from 0.0 to 10.0, mapped to severity ratings (e.g., 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical).

21. What are the three CVSS metric groups?

    Base (intrinsic characteristics that don't change over time), Temporal (characteristics that change over time, e.g., exploit availability), and Environmental (characteristics specific to a user's environment).

See more Security Assessment and Testing flashcards →

Planning Security Assessment and Testing for Certified Information Systems Security Professional (CISSP)

Security Assessment and Testing (Certified Information Systems Security Professional (CISSP)) FAQ