Certified Information Systems Security Professional (CISSP) Security Assessment and Testing Flashcards

24 sample cards from the Security Assessment and Testing deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is the difference between a vulnerability assessment and a penetration test?

   A vulnerability assessment identifies and lists weaknesses without exploiting them (broad, automated, lower risk). A penetration test actively exploits selected vulnerabilities to prove impact (focused, often manual, higher risk).

2. What are the rules of engagement (RoE) in a penetration test?

   A document defining the scope, timing, permitted targets and techniques, communication procedures, and legal authorization for the test—ensuring testing is authorized and bounded to avoid unintended damage or legal issues.

3. What is the difference between a red team, blue team, and purple team?

   Red team plays the attacker, attempting to breach defenses. Blue team plays the defender, detecting and responding. Purple team is a collaborative function where red and blue share knowledge in real time to improve both offense and defense.

4. What is static application security testing (SAST)?

   A white-box software testing technique that analyzes an application's source code, bytecode, or binary without executing it, to find vulnerabilities like injection flaws and insecure coding patterns early in development.

5. What is dynamic application security testing (DAST)?

   A black-box technique that tests a running application from the outside by sending inputs and observing responses to find runtime vulnerabilities such as authentication and injection issues, without access to source code.

6. What is the difference between static and dynamic code testing?

   Static testing examines code without running it (analyzes source/binary for flaws). Dynamic testing executes the code/application and observes its behavior with real inputs. They are complementary—static finds coding flaws early, dynamic finds runtime/configuration issues.

7. What is fuzz testing (fuzzing)?

   A dynamic technique that submits large amounts of malformed, random, or unexpected input to an application to trigger crashes, memory leaks, or unexpected behavior that reveal vulnerabilities.

8. Compare mutation fuzzing and generational fuzzing.

   Mutation (dumb) fuzzing modifies existing valid input samples to create test cases. Generational (intelligent) fuzzing builds new inputs from scratch based on a model of the expected input format/protocol, producing more targeted test cases.

9. What is the difference between white-box, gray-box, and black-box software testing?

   White-box: tester has full knowledge of internal code/structure. Gray-box: tester has partial knowledge (e.g., design docs but not full source). Black-box: tester has no knowledge of internals and tests only inputs/outputs.

10. What is code review, and what is the formal Fagan inspection process?

    Code review is examining source code to find defects and security flaws. A Fagan inspection is a formal, structured review with six steps: planning, overview, preparation, inspection (meeting), rework, and follow-up.

11. What is the difference between positive and negative testing?

    Positive testing verifies the application behaves correctly with valid, expected input. Negative testing verifies it handles invalid, unexpected, or malicious input gracefully (e.g., rejecting bad data without crashing).

12. What is regression testing and why does it matter for security?

    Regression testing re-runs prior tests after code changes to confirm that new modifications did not reintroduce old bugs or break existing functionality—including previously fixed security vulnerabilities.

13. What is misuse case testing (abuse case testing)?

    Testing that models how an attacker would deliberately misuse or abuse a feature, deriving test cases from threat scenarios rather than intended functionality, to verify the application resists hostile use.

14. What is test coverage analysis, and give the common coverage formula.

    It measures how much of the code or requirements is exercised by tests. A common formula is: test coverage = (number of use cases/lines/branches tested ÷ total number) × 100%. Types include statement, branch, condition, function, and loop coverage.

15. What is the difference between interface testing components: API, UI, and physical interface testing?

    API testing validates that application programming interfaces enforce security and handle data correctly. UI testing validates the graphical user interface behaves and restricts input properly. Physical interface testing validates hardware/peripheral connection points. All three ensure secure interaction at system boundaries.

16. What is log review and what is its primary security purpose?

    The examination of log records from systems, applications, and security devices to detect anomalies, policy violations, and incidents, and to support investigations and accountability. It is a detective control.

17. What is the difference between active and passive monitoring of system performance and security?

    Active (synthetic) monitoring injects simulated/artificial transactions to test behavior. Passive monitoring observes real, actual traffic and user activity as it happens without generating its own traffic.

18. What is synthetic transaction monitoring?

    A form of active monitoring that runs scripted, simulated user transactions against an application on a schedule to proactively measure availability, performance, and correct function before real users are affected.

19. What is real user monitoring (RUM) and how does it differ from synthetic monitoring?

    RUM is passive monitoring that captures and analyzes the actual interactions of real users with an application. Synthetic monitoring uses artificial scripted transactions. RUM reflects true user experience; synthetic provides consistent proactive coverage even with no live users.

20. Why is centralized log collection (e.g., a SIEM) important for log review?

    It aggregates logs from many sources into one place, enabling correlation across systems, protecting logs from tampering by attackers on the source host, ensuring consistent retention, and enabling automated alerting on suspicious patterns.

21. What is the purpose of collecting security process data (KPIs/KRIs)?

    To measure the effectiveness and performance of security processes (account management, backups, patching, training, etc.) over time using metrics, supporting management oversight, continuous improvement, and demonstrating due diligence.

22. What is the difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI)?

    A KPI measures how well a process is currently performing against its goals (looking at present/past effectiveness). A KRI is a forward-looking metric that signals increasing risk exposure, providing early warning of potential future problems.

23. What process data should be collected to demonstrate effective account management?

    Metrics on account provisioning and deprovisioning timeliness, results of access reviews, number of orphaned/dormant accounts found, privilege change records, and exceptions—showing accounts are created, reviewed, and removed appropriately.

24. What are the key elements of effective security assessment reporting and remediation?

    Clear findings prioritized by risk/severity, business impact, evidence, and actionable recommendations; an audience-appropriate format (technical detail for engineers, summary for executives); and a tracked remediation plan with assigned owners, deadlines, and verification (retesting) that fixes were applied.

What this deck covers

Security Assessment and Testing flashcards FAQ