Security Assessment and Testing GISP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security manager is planning the organization's annual security assessment. The organization has a mature security program with regular vulnerability scans and penetration tests. The manager wants to add a new assessment activity that provides a holistic view of the organization's security posture, including governance, risk, and compliance. The manager has a limited budget and must choose between a comprehensive security audit and a red team exercise. Which activity is more appropriate for this goal?

   • AA penetration test that validates the exploitability of known vulnerabilities.
   • BA red team exercise that simulates a sophisticated adversary to test the organization's detection and response capabilities.
   • CA vulnerability assessment that scans all systems and reports on technical weaknesses.
   • DA comprehensive security audit that evaluates the organization's security program against a framework such as ISO 27001.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common type of security assessment?

   • AEmployee performance review
   • BVulnerability assessment
   • CData backup verification
   • DNetwork capacity planning
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of tracking remediation efforts after a security assessment?

   • ATo assign blame to the teams responsible for the vulnerabilities
   • BTo justify the cost of the assessment to management
   • CTo ensure that identified vulnerabilities are addressed and to verify fixes
   • DTo create a permanent record of all past security incidents
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which security testing technique involves executing the application and observing its behavior?

   • AStatic analysis
   • BDynamic analysis
   • CArchitecture review
   • DCode review
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is planning a penetration test for a critical e-commerce platform. The test must validate whether an attacker can pivot from the public-facing web tier to the internal payment database. The team has a limited time window and must avoid disrupting live transactions. Which approach best meets these constraints?

   • APerform the penetration test in a production-like staging environment that includes the web tier and a replica of the payment database, with rules of engagement that prohibit destructive actions.
   • BRun the penetration test directly against production during off-peak hours to minimize the impact on transactions.
   • CConduct a vulnerability scan of the production environment and infer the pivot path from the scan results.
   • DUse only static analysis of the web application code to identify potential pivot points.
   Reveal Solution Discussion Select an answer first