Examius

🇺🇸 Certified Information Systems Security Professional (CISSP) · subject

Certified Information Systems Security Professional (CISSP) Security Assessment and Testing Syllabus

The Security Assessment and Testing syllabus for Certified Information Systems Security Professional (CISSP) in full: 3 chapters, 10 topics and 28 sub-topics, every one listed below, plus 50 Security Assessment and Testing flashcards with answers.

3Chapters
10Topics
28Sub-topics
50Flashcards

Security Assessment and Testing syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Assessment and Test Strategies

     3 topics
    • Designing Assessment Programs
      • Internal, external, and third-party assessments
      • Defining scope, rules of engagement, and objectives
      • Assessment standards and frameworks
    • Control Validation Approaches
      • Verification versus validation
      • Compliance checks and gap analysis
    • Account and Access Review
      • Reviewing user and privileged accounts
      • Service account hygiene

  2. Security Testing Techniques

     4 topics
    • Vulnerability Assessment
      • Automated scanning and authenticated scans
      • Network, host, and application scanning
      • False positive triage and CVSS scoring
    • Penetration Testing
      • Black-box, white-box, and gray-box testing
      • Reconnaissance, exploitation, and reporting phases
      • Red, blue, and purple team exercises
    • Software Testing Methods
      • Static application security testing (SAST)
      • Dynamic application security testing (DAST)
      • Fuzzing, misuse case testing, and code review
      • Interface and regression testing
    • Log Review and Synthetic Monitoring
      • Real user monitoring vs synthetic transactions
      • Log analysis for security events

  3. Audit and Reporting

     3 topics
    • Audit Strategies and Standards
      • Internal audits and management
      • External and third-party audits
      • SOC 1, SOC 2, and SOC 3 reports
    • Collecting Security Process Data
      • Key performance and risk indicators
      • Technical and management control metrics
      • Training and awareness effectiveness data
    • Reporting and Remediation
      • Writing actionable test reports
      • Risk-prioritized remediation tracking
      • Exception handling and ethical disclosure

Certified Information Systems Security Professional (CISSP) Security Assessment and Testing flashcards — 50 questions with answers

  1. What is a security assessment in the context of CISSP Domain 6?

    A comprehensive review of the security of a system, application, or environment that combines many tools and techniques (vulnerability scans, pen tests, log reviews, interviews) to gauge overall security posture, usually producing recommendations rather than a pass/fail result.

  2. How does a security audit differ from a security assessment?

    An audit is a formal, structured evaluation performed by an independent party against a specific standard or set of controls, producing attestation/evidence of compliance. An assessment is broader, often internal, and aimed at identifying and improving weaknesses rather than formally attesting to compliance.

  3. What is a security test?

    A verification that a specific security control is functioning properly, such as a vulnerability scan, penetration test, or configuration review. Tests are the granular activities that feed into broader assessments and audits.

  4. What three categories of audits are distinguished by who performs them?

    Internal audits (performed by the organization's own staff), external audits (performed by an outside firm), and third-party audits (performed by an independent auditor, often for regulatory or partner assurance).

  5. What is the purpose of the SOC (Service Organization Control) reporting framework?

    SOC reports, governed by SSAE 18, provide assurance about controls at a service organization so its customers can trust outsourced services. They are produced by independent auditors (typically CPAs).

  6. Compare SOC 1, SOC 2, and SOC 3 reports.

    SOC 1 covers controls relevant to financial reporting (ICFR). SOC 2 covers the five Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) and is restricted-use. SOC 3 is a public, general-use summary version of a SOC 2.

  7. What is the difference between a SOC Type I and a SOC Type II report?

    Type I assesses whether controls are suitably designed at a single point in time. Type II assesses both design AND operating effectiveness of controls over a period of time (typically 6-12 months), making it stronger assurance.

  8. What are the five Trust Services Criteria covered by a SOC 2 report?

    Security (the only mandatory one, called the Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.

  9. What is the purpose of designing a security assessment program?

    To ensure ongoing, systematic evaluation of controls by defining what will be tested, how often, by whom, with what tools, and how results are reported—aligning testing with risk, compliance requirements, and business objectives rather than ad hoc checks.

  10. What three sources of requirements typically drive the scope and frequency of a security assessment program?

    Risk to the organization (higher-risk systems tested more often), regulatory/compliance mandates (e.g., PCI DSS), and the value/sensitivity of the assets and data involved.

  11. What is the difference between control validation by examination, interview, and testing?

    Examination reviews documents/configurations/evidence; interview gathers information by questioning personnel; testing actively exercises the control (e.g., trying an exploit) to verify it works. These three methods are defined in NIST SP 800-53A.

  12. Distinguish a manual control test from an automated control test.

    A manual test requires a human to perform and evaluate it (e.g., reviewing a sample of access requests). An automated test uses tools/scripts to continuously or repeatedly verify the control (e.g., a scheduled vulnerability scan or configuration scanner).

  13. What is an account/access review and why is it performed?

    A periodic review of user accounts and their assigned privileges to verify they are still appropriate—detecting orphaned accounts, excessive privileges, dormant accounts, and violations of least privilege or separation of duties.

  14. What is privilege creep (aggregation) and how do access reviews address it?

    Privilege creep is the gradual accumulation of access rights as users change roles without old permissions being revoked. Access reviews detect and remove these excess privileges to restore least privilege.

  15. What is an orphaned account and why is it a security risk?

    An orphaned account is one that remains active after its owner has left the organization or no longer needs it. It is a risk because it can be exploited without anyone noticing the legitimate user is gone, and it lacks accountability.

  16. In access reviews, what is the difference between entitlement review and recertification?

    An entitlement review examines the specific permissions/rights granted to accounts. Recertification (attestation) is the process where a manager or data owner formally confirms that each user's access is still required and appropriate.

  17. What is a vulnerability assessment?

    The systematic identification, classification, and prioritization of security weaknesses (vulnerabilities) in systems, typically using automated scanners, without actively exploiting them.

  18. What is the difference between an authenticated (credentialed) and unauthenticated (uncredentialed) vulnerability scan?

    An authenticated scan logs into the target with valid credentials to inspect configuration and patch level from the inside, giving deeper and more accurate results. An unauthenticated scan probes only from the outside, like an external attacker, finding fewer issues with more false positives.

  19. What is a false positive versus a false negative in vulnerability scanning?

    A false positive is a reported vulnerability that does not actually exist. A false negative is a real vulnerability the scanner failed to detect—false negatives are more dangerous because the weakness goes unaddressed.

  20. What is CVSS and what range do its base scores use?

    The Common Vulnerability Scoring System is a standardized framework for rating the severity of vulnerabilities. Base scores range from 0.0 to 10.0, mapped to severity ratings (e.g., 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical).

Show the other 30 Security Assessment and Testing flashcards

  1. What are the three CVSS metric groups?

    Base (intrinsic characteristics that don't change over time), Temporal (characteristics that change over time, e.g., exploit availability), and Environmental (characteristics specific to a user's environment).

  2. What does CVE stand for and what does it provide?

    Common Vulnerabilities and Exposures—a standardized dictionary of publicly known security vulnerabilities, each assigned a unique CVE identifier so tools and people can reference the same flaw consistently.

  3. What is the SCAP standard used for in vulnerability management?

    The Security Content Automation Protocol is a NIST-maintained suite of specifications (including CVE, CVSS, CPE, OVAL, XCCDF) that standardizes how vulnerability and configuration data is expressed and exchanged so tools can interoperate.

  4. What is penetration testing?

    An authorized, simulated attack against a system in which testers actively attempt to exploit vulnerabilities to demonstrate real-world impact and validate the effectiveness of defenses, going beyond merely identifying weaknesses.

  5. List the typical phases of a penetration test.

    Planning/scoping (rules of engagement), reconnaissance/information gathering, scanning/enumeration, gaining access (exploitation), maintaining access/privilege escalation, and reporting/cleanup.

  6. Compare white-box, gray-box, and black-box penetration testing.

    White-box (full knowledge): testers have complete information about the target. Gray-box (partial knowledge): testers have limited information, like a typical insider. Black-box (zero knowledge): testers have no prior information, simulating an external attacker.

  7. What is the difference between a vulnerability assessment and a penetration test?

    A vulnerability assessment identifies and lists weaknesses without exploiting them (broad, automated, lower risk). A penetration test actively exploits selected vulnerabilities to prove impact (focused, often manual, higher risk).

  8. What are the rules of engagement (RoE) in a penetration test?

    A document defining the scope, timing, permitted targets and techniques, communication procedures, and legal authorization for the test—ensuring testing is authorized and bounded to avoid unintended damage or legal issues.

  9. What is the difference between a red team, blue team, and purple team?

    Red team plays the attacker, attempting to breach defenses. Blue team plays the defender, detecting and responding. Purple team is a collaborative function where red and blue share knowledge in real time to improve both offense and defense.

  10. What is static application security testing (SAST)?

    A white-box software testing technique that analyzes an application's source code, bytecode, or binary without executing it, to find vulnerabilities like injection flaws and insecure coding patterns early in development.

  11. What is dynamic application security testing (DAST)?

    A black-box technique that tests a running application from the outside by sending inputs and observing responses to find runtime vulnerabilities such as authentication and injection issues, without access to source code.

  12. What is the difference between static and dynamic code testing?

    Static testing examines code without running it (analyzes source/binary for flaws). Dynamic testing executes the code/application and observes its behavior with real inputs. They are complementary—static finds coding flaws early, dynamic finds runtime/configuration issues.

  13. What is fuzz testing (fuzzing)?

    A dynamic technique that submits large amounts of malformed, random, or unexpected input to an application to trigger crashes, memory leaks, or unexpected behavior that reveal vulnerabilities.

  14. Compare mutation fuzzing and generational fuzzing.

    Mutation (dumb) fuzzing modifies existing valid input samples to create test cases. Generational (intelligent) fuzzing builds new inputs from scratch based on a model of the expected input format/protocol, producing more targeted test cases.

  15. What is the difference between white-box, gray-box, and black-box software testing?

    White-box: tester has full knowledge of internal code/structure. Gray-box: tester has partial knowledge (e.g., design docs but not full source). Black-box: tester has no knowledge of internals and tests only inputs/outputs.

  16. What is code review, and what is the formal Fagan inspection process?

    Code review is examining source code to find defects and security flaws. A Fagan inspection is a formal, structured review with six steps: planning, overview, preparation, inspection (meeting), rework, and follow-up.

  17. What is the difference between positive and negative testing?

    Positive testing verifies the application behaves correctly with valid, expected input. Negative testing verifies it handles invalid, unexpected, or malicious input gracefully (e.g., rejecting bad data without crashing).

  18. What is regression testing and why does it matter for security?

    Regression testing re-runs prior tests after code changes to confirm that new modifications did not reintroduce old bugs or break existing functionality—including previously fixed security vulnerabilities.

  19. What is misuse case testing (abuse case testing)?

    Testing that models how an attacker would deliberately misuse or abuse a feature, deriving test cases from threat scenarios rather than intended functionality, to verify the application resists hostile use.

  20. What is test coverage analysis, and give the common coverage formula.

    It measures how much of the code or requirements is exercised by tests. A common formula is: test coverage = (number of use cases/lines/branches tested Ă· total number) Ă— 100%. Types include statement, branch, condition, function, and loop coverage.

  21. What is the difference between interface testing components: API, UI, and physical interface testing?

    API testing validates that application programming interfaces enforce security and handle data correctly. UI testing validates the graphical user interface behaves and restricts input properly. Physical interface testing validates hardware/peripheral connection points. All three ensure secure interaction at system boundaries.

  22. What is log review and what is its primary security purpose?

    The examination of log records from systems, applications, and security devices to detect anomalies, policy violations, and incidents, and to support investigations and accountability. It is a detective control.

  23. What is the difference between active and passive monitoring of system performance and security?

    Active (synthetic) monitoring injects simulated/artificial transactions to test behavior. Passive monitoring observes real, actual traffic and user activity as it happens without generating its own traffic.

  24. What is synthetic transaction monitoring?

    A form of active monitoring that runs scripted, simulated user transactions against an application on a schedule to proactively measure availability, performance, and correct function before real users are affected.

  25. What is real user monitoring (RUM) and how does it differ from synthetic monitoring?

    RUM is passive monitoring that captures and analyzes the actual interactions of real users with an application. Synthetic monitoring uses artificial scripted transactions. RUM reflects true user experience; synthetic provides consistent proactive coverage even with no live users.

  26. Why is centralized log collection (e.g., a SIEM) important for log review?

    It aggregates logs from many sources into one place, enabling correlation across systems, protecting logs from tampering by attackers on the source host, ensuring consistent retention, and enabling automated alerting on suspicious patterns.

  27. What is the purpose of collecting security process data (KPIs/KRIs)?

    To measure the effectiveness and performance of security processes (account management, backups, patching, training, etc.) over time using metrics, supporting management oversight, continuous improvement, and demonstrating due diligence.

  28. What is the difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI)?

    A KPI measures how well a process is currently performing against its goals (looking at present/past effectiveness). A KRI is a forward-looking metric that signals increasing risk exposure, providing early warning of potential future problems.

  29. What process data should be collected to demonstrate effective account management?

    Metrics on account provisioning and deprovisioning timeliness, results of access reviews, number of orphaned/dormant accounts found, privilege change records, and exceptions—showing accounts are created, reviewed, and removed appropriately.

  30. What are the key elements of effective security assessment reporting and remediation?

    Clear findings prioritized by risk/severity, business impact, evidence, and actionable recommendations; an audience-appropriate format (technical detail for engineers, summary for executives); and a tracked remediation plan with assigned owners, deadlines, and verification (retesting) that fixes were applied.

Certified Information Systems Security Professional (CISSP) Security Assessment and Testing FAQ

What is in the Certified Information Systems Security Professional (CISSP) Security Assessment and Testing syllabus?

Certified Information Systems Security Professional (CISSP) Security Assessment and Testing is split into 3 chapters: Assessment and Test Strategies, Security Testing Techniques and Audit and Reporting. Together they contain 10 topics and 28 sub-topics.

How many chapters are in Certified Information Systems Security Professional (CISSP) Security Assessment and Testing?

3 chapters, containing 10 topics and 28 sub-topics. The largest chapter is Security Testing Techniques, with 4 topics.

Are there flashcards for Certified Information Systems Security Professional (CISSP) Security Assessment and Testing?

Yes — a 50-card Security Assessment and Testing deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.